Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Intelligence Briefing 16 January 2026
Black Arrow Cyber Threat Intelligence Briefing 16 January 2026:
-We’re Moving Too Fast: Why AI’s Race to Market Is a Security Disaster
-The Speed Mismatch Putting Modern Security At Risk
-New Intelligence Is Moving Faster than Enterprise Controls
-Cyber Risk Enters a New Era as AI and Supply Chains Reshape Global Security
-Allianz Risk Barometer 2026: Cyber Remains Top Business Risk but AI Fastest Riser at #2
-Downtime Pushes Resilience Planning into Security Operations
-Executives More Likely to Take Phishing Bait than Junior Staff
-QR Codes Are Getting Colourful, Fancy, and Dangerous
-Convincing LinkedIn Comment-Reply Tactic Used in New Phishing
-Cyber Criminals Recruiting Insiders at Specific Organisations
-Ransomware Activity Surges to Record Levels
-State-Backed Cyberattacks Are No Longer a Government Problem – They’re Now a Boardroom Priority
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
Looking at various sources in this week’s review, the recurring conclusion is the need for organisations to make sure they understand the risks of AI before and during its use. Examples include a vulnerability in popular business software that allowed abuse by attackers, while organisations are deploying AI faster than their security. AI, and cyber risks in general, are top business risks according to research by the World Economic Forum and Allianz.
From a business leadership perspective, cyber reliance is increasingly important, yet research shows that executives are more likely to fall for a phishing attack. We look at emerging threats to businesses, including stylised QR codes, LinkedIn scams and attackers recruiting insiders to gain entry to targeted organisations. Ransomware remains a primary risk and is at record levels.
We are consistent in our messaging on how business leaders should address these risks. Ensure you have a contemporary understanding of how cyber is evolving, through our weekly threat intelligence briefings and leadership training, and establish a proportionate strategy to address the risks across people, operations and technology. By gaining your own impartial perspective, you will be better placed to govern and challenge others who are designing and maintaining your security controls.
Top Cyber Stories of the Last Week
We’re Moving Too Fast: Why AI’s Race to Market Is a Security Disaster
A critical ServiceNow AI vulnerability demonstrates how weaknesses introduced during rapid AI deployment can lead to serious security failures. The flaw allowed unauthenticated attackers to impersonate administrators and abuse AI agents. Default configurations, weak authentication and limited oversight are common in agentic AI systems, expanding organisational attack surfaces and enabling privilege abuse through automation.
The Speed Mismatch Putting Modern Security At Risk
Attackers now operate at machine speed, while many organisations still rely on quarterly or annual security checks. This gap creates hidden risk, as vulnerabilities can appear and disappear between reviews and be exploited before they are identified. Security validation must move away from periodic checks and keep pace with continuously changing systems and attack activity.
New Intelligence Is Moving Faster than Enterprise Controls
Enterprises are deploying AI faster than supporting infrastructure, governance and data controls can keep up, according to NTT research. Only a small proportion of organisations can operate AI at scale, with infrastructure limits and weak data hygiene creating security and reliability risks. The use of unsanctioned AI tools raises concerns around data leakage and inaccurate outputs, while governance maturity varies widely.
Source: https://www.helpnetsecurity.com/2026/01/16/ntt-data-enterprise-ai-governance/
Cyber Risk Enters a New Era as AI and Supply Chains Reshape Global Security
According to the World Economic Forum’s Global Cybersecurity Outlook 2026, AI‑related vulnerabilities surged more than any other cyber risk in 2025. Many organisations reported sensitive data leaking through generative AI tools as adoption outpaces governance, and a significant share of respondents expressed growing concern over attackers’ use of advanced AI capabilities. Uneven cyber security strength across suppliers and regions increases the risk that incidents spread beyond individual organisations, causing wider disruption across connected ecosystems.
Source: https://petri.com/cyber-risk-ai-supply-chains-global-security/
Allianz Risk Barometer 2026: Cyber Remains Top Business Risk but AI Fastest Riser at #2
Cyber incidents remain the top global business risk for the fifth consecutive year, ranked number one by 42% of respondents worldwide, driven largely by ransomware. AI rose from #10 to #2 as adoption accelerates faster than governance, creating operational, legal and reputational risk. Supply chain dependence and third‑party exposure continue to amplify the impact of disruption across businesses of all sizes.
Downtime Pushes Resilience Planning into Security Operations
Operational disruption and prolonged downtime caused by security incidents are becoming routine, with recovery often taking days and direct remediation costs reaching millions. These impacts are now prominent in board discussions. In response, research shows that CISOs are increasingly defining success in their role based on recovery and continuity rather than prevention alone, with growing executive expectations and accountability for restoring operations from risks including ransomware, supply chains, insiders and failures in trusted security software.
Source: https://www.helpnetsecurity.com/2026/01/12/absolute-ciso-resilience-planning/
Executives More Likely to Take Phishing Bait than Junior Staff
Yubico data shows over 11% of C‑suite respondents interacted with phishing in the past week, compared to 8.8% of entry‑level staff. Perception gaps persist, with 44% of C‑suite respondents saying they believe their organisation’s cyber security is “very good”, compared with 25% of entry‑level staff. Small businesses show low training and MFA adoption, increasing exposure to AI‑driven social engineering.
Source: https://betanews.com/article/executives-more-likely-to-take-phishing-bait-than-junior-staff/
QR Codes Are Getting Colourful, Fancy, and Dangerous
QR codes are increasingly used by attackers in phishing campaigns known as quishing. Research highlights how stylised QR codes using colours, logos and backgrounds preserve scan reliability while evading traditional URL inspection and email security controls. Industry data shows 22% of QR‑related attacks involve phishing, with state‑sponsored and criminal actors using redirection chains to harvest credentials via mobile devices.
Source: https://www.helpnetsecurity.com/2026/01/15/fancy-qr-codes-phishing-risk/
Convincing LinkedIn Comment-Reply Tactic Used in New Phishing
Attackers are posting fake LinkedIn comment replies impersonating the platform to claim policy violations and drive users to phishing sites. Some campaigns abuse LinkedIn’s own lnkd.in shortener, obscuring destinations. Fake company pages using LinkedIn branding have been identified, with LinkedIn confirming it does not notify users of violations via public comments.
Cyber Criminals Recruiting Insiders at Specific Organisations
Dark web forums show criminals actively seeking insiders at named organisations to access customer data and internal systems. Listings target crypto firms, consultancies and consumer platforms, offering payments of $3,000–$15,000. Insiders can bypass standard alerts, with researchers citing previous incidents where recruited employees enabled large‑scale data theft and financial loss.
Source: https://www.itpro.com/security/cyber-criminals-recruiting-insiders-at-specific-organizations
Ransomware Activity Surges to Record Levels
Global ransomware activity reached record levels in 2025, with 2,287 victims reported in Q4 alone and 124 active ransomware groups, a 46% year‑on‑year increase. Victim numbers rose 58% as law enforcement pressure fragmented larger groups of attackers into many smaller operators running frequent, repeatable attacks. The US accounted for 55% of victims, but activity remains global and sustained.
Source: https://betanews.com/article/ransomware-activity-surges-to-record-levels/
State-Backed Cyberattacks Are No Longer a Government Problem – They’re Now a Boardroom Priority
State‑backed actors increasingly target private organisations and supply chains rather than governments alone. The UK NCSC handled 204 nationally significant incidents in 12 months, up from 89 the previous year. Smaller suppliers are frequently exploited as backdoors, with resilience, governance and supply chain controls highlighted as practical responses to persistent geopolitical cyber threats.
Governance, Risk and Compliance
Executives more likely to take phishing bait than junior staff - BetaNews
Businesses in 2026: AI security oh yeah better look at that • The Register
Business leaders see AI risks and fraud outpacing ransomware, says WEF | Computer Weekly
Privacy and Cybersecurity Laws in 2026 Pose Challenges
Downtime pushes resilience planning into security operations - Help Net Security
Cyber Risk Enters a New Era as AI Reshapes Global Security
CISOs flag gaps in third-party risk management - Help Net Security
CISO Succession Crisis Highlights How Turnover Amplifies Risks
Allianz Risk Barometer 2026: Cyber Remains Top Business Risk but AI Fastest Riser at #2
CISO Role Reaches “Inflexion Point” With Executive-Level Titles - Infosecurity Magazine
Technology dominates global risk concerns – Allianz
What insurers expect from cyber risk in 2026 - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
The Ransomware Paradox: Why Payments Are Soaring as Attacks “Drop” | MSSP Alert
Ransomware activity surges to record levels - BetaNews
Ransomware activity never dies, it multiplies - Help Net Security
Business leaders see AI risks and fraud outpacing ransomware, says WEF | Computer Weekly
Threat Actors Attacking Systems with 240+ Exploits Before Ransomware Deployment
Ransomware: Tactical Evolution Fuels Extortion Epidemic | SECURITY.COM
Takedowns and arrests didn't slow down ransomware in 2025 | TechRadar
DeadLock ransomware uses smart contracts to evade defenders • The Register
Ransomware by the Numbers: Count of Victims and Groups Surge
Fog Ransomware Attacking US Organizations Leveraging Compromised VPN Credentials
France swaps alleged ransomware crook for conflict researcher • The Register
Sicarii Ransomware: Truth vs Myth - Check Point Research
MEED | Construction is third most targeted sector by ransomware
Ransomware Victims
South Korean giant Kyowon confirms data theft in ransomware attack
Cyberattack forces Belgian hospitals to cancel surgeries | Cybernews
Government statement on 'serious cyber attack' at Nuneaton school | Coventry Live
Belgian hospitals refuse ambulances following cyberattack • The Register
Phishing & Email Based Attacks
Executives more likely to take phishing bait than junior staff - BetaNews
QR codes are getting colorful, fancy, and dangerous - Help Net Security
FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes - SecurityWeek
North Korea turns QR codes into phishing weapons • The Register
FBI Flags Quishing Attacks From North Korean APT
Why can’t companies stop social engineering attacks?
Hackers Use Fake PayPal Notices to Steal Credentials, Deploy RMMs - Infosecurity Magazine
Trellix warns of advanced Facebook phishing using browser-in-the-browser attacks - SiliconANGLE
Facebook login thieves now using browser-in-browser trick
Phishing scammers are posting fake “account restricted” comments on LinkedIn | Malwarebytes
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors
Why QR Codes Are Education's New Phishing Blind Spot - Security Boulevard
Fake Facebook pop-ups mimic browser window | Cybernews
Browser-in-the-Browser phishing is on the rise: Here's how to spot it - Help Net Security
China spies used Maduro capture as lure to phish US agencies • The Register
Other Social Engineering
QR codes are getting colorful, fancy, and dangerous - Help Net Security
Impersonation Fraud Drives Record $17bn in Crypto Losses - Infosecurity Magazine
Why can’t companies stop social engineering attacks?
Hackers Use Fake PayPal Notices to Steal Credentials, Deploy RMMs - Infosecurity Magazine
Phishing scammers are posting fake “account restricted” comments on LinkedIn | Malwarebytes
Fake Facebook pop-ups mimic browser window | Cybernews
Browser-in-the-Browser phishing is on the rise: Here's how to spot it - Help Net Security
Artificial Intelligence
Businesses in 2026: AI security oh yeah better look at that • The Register
Business leaders see AI risks and fraud outpacing ransomware, says WEF | Computer Weekly
Cyber Risk Enters a New Era as AI Reshapes Global Security
Allianz Risk Barometer 2026: Cyber Remains Top Business Risk but AI Fastest Riser at #2
WEF: Deepfake Face-Swapping Tools Are Creating Critical Risks - Infosecurity Magazine
Top cyber threats to your AI systems and infrastructure | CSO Online
LLMs in Attacker Crosshairs, Warns Threat Intel Firm - SecurityWeek
We’re Moving Too Fast: Why AI’s Race to Market Is a Security Disaster - Security Boulevard
New intelligence is moving faster than enterprise controls - Help Net Security
AI-Powered Truman Show Operation Industrializes Investment Fraud - Infosecurity Magazine
Hackers target misconfigured proxies to access paid LLM services
Generative AI in Enterprises: Security Risks Most Companies Are Not Measuring - Security Boulevard
Mac users are being targeted by a fake Grok app, and it's powered by AI - PhoneArena
AI driving serious fraud spike – WEF
What Should We Learn From How Attackers Leveraged AI in 2025?
Your Copilot data can be hijacked with a single click - here's how | ZDNET
AI Agents Are Becoming Authorization Bypass Paths
The quiet way AI normalizes foreign influence | CyberScoop
Malaysia and Indonesia block X over deepfake smut • The Register
Elon Musk calls UK government ‘fascist’ over touted X ban
California AG launches investigation into X’s sexualized deepfakes | CyberScoop
Vibe coding security risks and how to mitigate them | TechTarget
Ofcom continues X probe despite Grok 'nudify' fix • The Register
Bots/Botnets
Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers
GoBruteforcer Botnet Targeting Crypto, Blockchain Projects - SecurityWeek
Careers, Roles, Skills, Working in Cyber and Information Security
We're losing in recruitment | Professional Security Magazine
Cloud/SaaS
New Linux malware targets the cloud, steals creds, then vanishes • The Register
New Chinese-Made Malware Framework Targets Linux Cloud Environments - Infosecurity Magazine
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Impersonation Fraud Drives Record $17bn in Crypto Losses - Infosecurity Magazine
Crypto crime hits record levels as state actors move billions - Help Net Security
GoBruteforcer Botnet Targeting Crypto, Blockchain Projects - SecurityWeek
Betterment Customer Data Accessed in Online Crypto Scam Attack
Cyber Crime, Organised Crime & Criminal Actors
Russia’s Cyber Sanctuary in Transition: Implications for Global Cybercrime | Geopolitical Monitor
Europol Leads Global Crackdown on Black Axe Cybercrime Gang, 34 Arrest - Infosecurity Magazine
The country at the heart of the global scam industry
Exclusive research: Cybersecurity issues may worsen in 2026 | PaymentsSource | American Banker
The New Threats: Attackers Don't Just Break In, They Blend In - The New Stack
We're losing in recruitment | Professional Security Magazine
Why are cybercriminals getting younger? | TechRadar
BreachForums Breach Exposes 324K Cybercriminals
Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages
BreachForums Data Leak Raises Fresh Questions Over Credibility - IT Security Guru
Data Breaches/Leaks
Russia’s Fancy Bear APT Doubles Down on Global Secrets Theft
France fines telcos €42M for issues leading to 2024 breach • The Register
California bans data broker reselling health data of millions
After Goldman, JPMorgan Discloses Law Firm Data Breach - SecurityWeek
Sensitive data of Eurail, Interrail travelers compromised in data breach - Help Net Security
BreachForums Data Leak Raises Fresh Questions Over Credibility - IT Security Guru
BreachForums hacking forum database leaked, exposing 324,000 accounts
Manage My Health starts notifying affected practices after major cyber breach | Cybernews
Second health provider, Canopy Health, hit in major cyber attack | RNZ News
Central Maine Healthcare breach exposed data of over 145,000 people
Instagram denies data breach after password reset emails spark leak claims - SiliconANGLE
Target employees confirm leaked source code is authentic
Threat actor claims the theft of full customer data from Spanish energy firm Endesa
Denial of Service/DoS/DDoS
ICE Agent Doxxing Site DDoS-ed Via Russian Servers - Infosecurity Magazine
Encryption
EU’s Chat Control could put government monitoring inside robots - Help Net Security
Michael Tsai - Blog - UK Child Protections and Messaging Backdoor
WFE Urges Regulators to Balance Quantum Risks With Immediate Cyber Threats - FinanceFeeds
G7 Sets 2034 Deadline for Finance to Adopt Quantum-Safe Systems - Infosecurity Magazine
Fraud, Scams and Financial Crime
Impersonation Fraud Drives Record $17bn in Crypto Losses - Infosecurity Magazine
Cyber Fraud Overtakes Ransomware as Top CEO Concern: WEF - SecurityWeek
WEF: Deepfake Face-Swapping Tools Are Creating Critical Risks - Infosecurity Magazine
The country at the heart of the global scam industry
Exclusive research: Cybersecurity issues may worsen in 2026 | PaymentsSource | American Banker
Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages
AI-Powered Truman Show Operation Industrializes Investment Fraud - Infosecurity Magazine
AI driving serious fraud spike – WEF
Phishing scammers are posting fake “account restricted” comments on LinkedIn | Malwarebytes
Online shoppers at risk as Magecart skimming hits major payment networks | Malwarebytes
Identity and Access Management
AI Agents Are Becoming Authorization Bypass Paths
Insurance
What insurers expect from cyber risk in 2026 - Help Net Security
US regulator tells GM to hit the brakes on customer tracking • The Register
Insider Risk and Insider Threats
Cyber criminals recruiting insiders at specific organizations | IT Pro
Internet of Things – IoT
Is your smart home at risk of being hacked? 6 ways experts lock theirs down | ZDNET
Sorry I'm late for work boss, my car's been hacked | Autocar
Why hacking could be the biggest threat facing automotive | Autocar
Multiple Hikvision Vulnerabilities Let Attackers Cause Device Malfunction Using Crafted Packets
China targets US cybersecurity firms, Tesla's FSD subscription
Law Enforcement Action and Take Downs
Takedowns and arrests didn't slow down ransomware in 2025 | TechRadar
Europol Leads Global Crackdown on Black Axe Cybercrime Gang, 34 Arrest - Infosecurity Magazine
Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam • The Register
Why are cybercriminals getting younger? | TechRadar
Hacker gets seven years for breaching Rotterdam and Antwerp ports
'Violence-as-a-service' suspect arrested • The Register
Appeal fails for hacker who opened port to coke smugglers • The Register
Illinois man charged with hacking Snapchat accounts to steal nude photos
Linux and Open Source
New Linux malware targets the cloud, steals creds, then vanishes • The Register
GoBruteforcer Botnet Targets 50K-plus Linux Servers
New Chinese-Made Malware Framework Targets Linux Cloud Environments - Infosecurity Magazine
Europe Has a New Plan to Break Free from US Tech Dominance
Malware
New Linux malware targets the cloud, steals creds, then vanishes • The Register
ValleyRAT_S2 Attacking Organizations to Deploy Stealthy Malware and Extract Financial Details
GoBruteforcer Botnet Targets 50K-plus Linux Servers
Mac users are being targeted by a fake Grok app, and it's powered by AI - PhoneArena
Beware of Weaponized Employee Performance Reports that Deploys Guloader Malware
New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack
How real software downloads can hide remote backdoors | Malwarebytes
Gootloader now uses 1,000-part ZIP archives for stealthy delivery
Dutch cops cuff alleged AVCheck malware kingpin in Amsterdam • The Register
Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers
China-linked UAT-7290 spies on telco in South Asia and Europe using modular malware
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
Misinformation, Disinformation and Propaganda
The quiet way AI normalizes foreign influence | CyberScoop
Mobile
Your phone is sharing data without your knowledge - how to stop it ASAP | ZDNET
Apple iPhone Attacks Confirmed — Experts Warn 'Update Now or Stay Exposed' | IBTimes
Tories want kids off social media and phones out of schools • The Register
Models, Frameworks and Standards
UK government exempting itself from flagship cyber law inspires little confidence • The Register
Parliament Asks Security Pros to Shape Cyber Security and Resilience Bill - Infosecurity Magazine
Michael Tsai - Blog - UK Child Protections and Messaging Backdoor
Outages
Investor Lawsuit Over CrowdStrike Outage Dismissed - SecurityWeek
Verizon blames nationwide outage on a "software issue"
Passwords, Credential Stuffing & Brute Force Attacks
Fog Ransomware Attacking US Organizations Leveraging Compromised VPN Credentials
Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations
Regulations, Fines and Legislation
UK government exempting itself from flagship cyber law inspires little confidence • The Register
Privacy and Cybersecurity Laws in 2026 Pose Challenges
France fines telcos €42M for issues leading to 2024 breach • The Register
Elon Musk calls UK government ‘fascist’ over touted X ban
California AG launches investigation into X’s sexualized deepfakes | CyberScoop
EU’s Chat Control could put government monitoring inside robots - Help Net Security
Dems pressure Google, Apple to drop X app as international regulators turn up heat | CyberScoop
Ofcom continues X probe despite Grok 'nudify' fix • The Register
The US doesn’t need a Cyber Force: it needs to prioritize cybersecurity
Hill warning: Don’t put cyber offense before defense | CyberScoop
Treat US tech firms the same as Chinese providers say campaigners | UKAuthority
UK backtracks on digital ID requirement for right to work • The Register
US cybersecurity weakened by congressional delays despite Plankey renomination | CSO Online
Social Media
Phishing scammers are posting fake “account restricted” comments on LinkedIn | Malwarebytes
Ofcom continues X probe despite Grok 'nudify' fix • The Register
Browser-in-the-Browser phishing is on the rise: Here's how to spot it - Help Net Security
Trellix warns of advanced Facebook phishing using browser-in-the-browser attacks - SiliconANGLE
Facebook login thieves now using browser-in-browser trick
Tories want kids off social media and phones out of schools • The Register
Instagram says it fixed the issue behind shady password reset emails - Digital Trends
Instagram denies breach amid claims of 17 million account data leak
Supply Chain and Third Parties
Cyber Risk Enters a New Era as AI Reshapes Global Security
CISOs flag gaps in third-party risk management - Help Net Security
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
The quiet way AI normalizes foreign influence | CyberScoop
Is the US adopting the gray zone cyber playbook? | CyberScoop
Estonia: Small State Security and the International Order
Taiwan Endures Greater Cyber Pressure From China
Nation State Actors
Cyber Risk Enters a New Era as AI Reshapes Global Security
The quiet way AI normalizes foreign influence | CyberScoop
Crypto crime hits record levels as state actors move billions - Help Net Security
China
New Linux malware targets the cloud, steals creds, then vanishes • The Register
China crew abused ESXi zero-days a year before disclosure • The Register
Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways
New Chinese-Made Malware Framework Targets Linux Cloud Environments - Infosecurity Magazine
China-linked UAT-7290 spies on telco in South Asia and Europe using modular malware
China bans U.S. and Israeli cybersecurity software over security concerns
Taiwan Endures Greater Cyber Pressure From China
China spies used Maduro capture as lure to phish US agencies • The Register
Treat US tech firms the same as Chinese providers say campaigners | UKAuthority
Russia
Russia’s Fancy Bear APT Doubles Down on Global Secrets Theft
Russia’s Cyber Sanctuary in Transition: Implications for Global Cybercrime | Geopolitical Monitor
Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations
Russia-linked APT28 targets energy and defense groups tied to NATO | SC Media
Ukraine's army targeted in new charity-themed malware campaign
PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
ICE Agent Doxxing Site DDoS-ed Via Russian Servers - Infosecurity Magazine
France swaps alleged ransomware crook for conflict researcher • The Register
Estonia: Small State Security and the International Order
North Korea
FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes - SecurityWeek
North Korea turns QR codes into phishing weapons • The Register
FBI Flags Quishing Attacks From North Korean APT
Iran
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors
Iran cuts Internet nationwide amid deadly protest crackdown
‘Kill Switch’—Iran Shuts Down Starlink Internet For First Time
Trump’s cyber options in Iran - POLITICO
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Cyber Risk Enters a New Era as AI Reshapes Global Security
The quiet way AI normalizes foreign influence | CyberScoop
Venezuelan Oil Industry Is Running on WhatsApp After Cyberattack - Bloomberg
Trump’s cyber options in Iran - POLITICO
Treat US tech firms the same as Chinese providers say campaigners | UKAuthority
Is the US adopting the gray zone cyber playbook? | CyberScoop
How hackers fight back against ICE surveillance tech • The Register
Tools and Controls
Hackers Use Fake PayPal Notices to Steal Credentials, Deploy RMMs - Infosecurity Magazine
CISOs flag gaps in third-party risk management - Help Net Security
Fog Ransomware Attacking US Organizations Leveraging Compromised VPN Credentials
Vibe coding security risks and how to mitigate them | TechTarget
Downtime pushes resilience planning into security operations - Help Net Security
China bans U.S. and Israeli cybersecurity software over security concerns
What insurers expect from cyber risk in 2026 - Help Net Security
The 2 faces of AI: How emerging models empower and endanger cybersecurity | CSO Online
DRAM shortage may drive firewall prices higher: analysts • The Register
Deploying AI agents is not your typical software launch - 7 lessons from the trenches | ZDNET
Reports Published in the Last Week
The State of Ransomware in the U.S.: Report and Statistics 2025
Other News
The Speed Mismatch Putting Modern Security At Risk
UK establishes Government Cyber Unit to protect against large-scale cyberattacks - SZR | УНН
New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification
Cyber body ISC2 signs on as UK software security ambassador | Computer Weekly
Hedge funds step up cybersecurity spending amid rising threats and regulatory pressure - Hedgeweek
Act Now To Enhance Your Business's Cyber Resilience - British Chambers of Commerce
Cyber Threat Actors Ramp Up Attacks on Industrial Environments - Infosecurity Magazine
The concerning cyber-physical security disconnect | SC Media
The US doesn’t need a Cyber Force: it needs to prioritize cybersecurity
Vulnerability Management
Vulnerabilities Surge, But Messy Reporting Blurs Picture
Vulnerabilities
Hackers Launched 8.1 Million Attack Sessions to React2Shell Vulnerability
China crew abused ESXi zero-days a year before disclosure • The Register
Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways
Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws
PoC exploit for critical FortiSIEM vulnerability released (CVE-2025-64155) - Help Net Security
Apple iPhone Attacks Confirmed — Experts Warn 'Update Now or Stay Exposed' | IBTimes
Hackers exploit Modular DS WordPress plugin flaw for admin access
Microsoft SQL Server Vulnerability Allows Attackers to Elevate Privileges over a Network
Hundreds of Millions of Audio Devices Need a Patch to Prevent Wireless Hacking and Tracking | WIRED
Flipping one bit leaves AMD CPUs open to VM vuln • The Register
Trend Micro Patches Critical Code Execution Flaw in Apex Central - SecurityWeek
CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution
'Most Severe AI Vulnerability to Date' Hits ServiceNow
Adobe Patches Critical Apache Tika Bug in ColdFusion - SecurityWeek
SAP's January 2026 Security Updates Patch Critical Vulnerabilities - SecurityWeek
Broadcom Wi-Fi Chipset Flaw Allows Hackers to Disrupt Networks - SecurityWeek
8000+ SmarterMail Hosts Vulnerable to RCE Attack - PoC Exploit Released
US government told to patch high-severity Gogs security issue or face attack | TechRadar
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Advisory - 14 January 2026 - Security Updates - Microsoft, SAP, Adobe
Black Arrow Cyber Advisory - 14 January 2026 - Security Updates - Microsoft, SAP, Adobe
Executive Summary
January’s security releases are dominated by Microsoft’s Patch Tuesday, which addresses over a hundred CVEs and includes an actively exploited zero-day, alongside SAP fixes containing multiple critical issues and Adobe updates across key Creative Cloud applications plus ColdFusion. The highest risks this month centre on remote code execution, elevation of privilege, and injection flaws affecting business-critical and user-facing systems. Prioritise patching for internet-facing services, identity and access components, and widely deployed endpoint and productivity tooling.
Vulnerabilities by Vendor
Microsoft[1]: 112 vulnerabilities, affecting Windows, Microsoft 365 and Office, browser components, developer tools, and enterprise services. Prioritise updates addressing actively exploited vulnerabilities and critical remote code execution or privilege escalation paths, especially on internet facing and end user endpoints.
SAP[2]: 19 vulnerabilities affecting SAP S/4HANA (private cloud and on premise), SAP HANA, SAP NetWeaver (including AS ABAP and Enterprise Portal), RFCSDK, Identity Management, and supporting components. Prioritise critical and high severity fixes first, particularly where systems are exposed to users, integrations, or administrative workflows.
Adobe[3]: 25 vulnerabilities affecting Creative Cloud applications (including Dreamweaver, InDesign, Illustrator, InCopy, Bridge, and Substance 3D tools) plus ColdFusion. Prioritise updates that address arbitrary code execution, and treat ColdFusion as urgent where it is deployed in production or accessible to untrusted inputs.
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
Footnotes:
1 Microsoft — https://msrc.microsoft.com/update-guide/releaseNote/2026-Jan
2 SAP — https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html
3 Adobe — https://helpx.adobe.com/security.html
Black Arrow Cyber: 5 Cyber Predictions for Business Leaders in 2026, and What You Need to Do
Throughout the year in our weekly Cyber Threat Intelligence Briefing, we bring you insights into the evolving cyber risks that your business faces and importantly, what you can do about them. As a business leader, you are not expected to be a cyber expert; you just need a sound grasp of the fundamentals, and an objective assessment of your risks and controls from an impartial expert so you can appropriately challenge your control providers. Proportionality and impartiality are key, and so too is keeping up to date with how the ground is shifting.
Throughout the year in our weekly Cyber Threat Intelligence Briefing, we bring you insights into the evolving cyber risks that your business faces and importantly, what you can do about them. As a business leader, you are not expected to be a cyber expert; you just need a sound grasp of the fundamentals, and an objective assessment of your risks and controls from an impartial expert so you can appropriately challenge your control providers. Proportionality and impartiality are key, and so too is keeping up to date with how the ground is shifting.
Here are five of our focus areas for this year, to help keep your business running in a more secure environment. Other risks such as ransomware and business email compromise remain high on the list too. We discuss these and many others in our weekly threat intelligence email; subscribe today and contact us for impartial expertise on how to address your risks through proportionate security.
1. Tailored Attacks Using Agentic AI
Agentic AI tools can autonomously design and execute attacks, leveraging resources they identify. We already saw examples in 2025, and this will ramp up in 2026. The result is faster and more potent attacks, tailored to the victim.
What to do: review your controls including vulnerability management, access management, and monitoring and detection. And keep your finger on the pulse through good governance; this includes discussing reports and knowing how to challenge what you see, and keeping abreast of evolving risks through threat intelligence.
2. Deepfake and Voice AI Become Commonplace
What was considered sophisticated deepfake in 2025 will be commonplace in 2026. Technology has advanced and is more widely used since the infamous $25m deepfake payment fraud in Hong Kong. AI deepfake video and voice will be used increasingly in social engineering attacks for fraudulent payment callbacks, malicious employee recruitment, and other attacks.
What to do: assess your security across your people, operations and technology, because that is what the attacker is doing. Review your controls and processes, including the use of purchase orders and outbound callback checks. Train your people on why the controls exist, how to stick to them, and how to raise a flag if something is unusual such as someone scheduling a work call via WhatsApp.
3. Break In Through the Supply Chain
When attackers compromise a service provider, such as an MSP or payroll provider, they can access the systems and data of all its customers, including yours. Remember also, it’s about your supply chain, not just your suppliers. For example, consider how readily you click on a SharePoint link in a client email, and whether that email could be sent by an attacker lurking in your client’s systems.
What to do: Check how your third parties identify and mitigate the risk of attacker access. Do this by asking targeted questions, and evaluating the responses including with support from impartial experts. From this, assess what controls you need to have to manage any resulting risks to you.
4. Regulatory Consequences
Regulators are taking a harder line on penalties after a cyber or data breach. Looking at the published reports by authorities in different countries, they appear increasingly frustrated when breaches harm the public due to organisations failing to implement proportionate security measures. Regulations are tightening, from the EU’s DORA in 2025 to new laws anticipated in countries such as the UK.
What to do: implement proportionate and credible governance over your cyber security; the UK’s Cyber Governance Code of Practice is a good starting point, and note its repeated use of “Gain assurance that…”. This means avoiding ‘compliance theatre’, instead recognising that the true objective is to defend yourself against the attacker, not just the regulator.
5. Resilience and Security
We see a greater focus on cyber resilience, building on and going beyond the foundations of cyber security. Good security can reduce the frequency and impact of a cyber incident, while cyber resilience requires business leaders to acknowledge evolving attacker tactics and ask ‘Yes, we have some good security, but what do we do if someone still gets through?’. In late 2025 for example, the UK Government wrote to business leaders urging them to prepare for managing a cyber incident.
What to do: get your leadership team together in a workshop, assume an attacker has breached your security, and work through your responses across people, operations and technology. The conversation needs to be run by a skilled cyber specialist who is not a control provider, to freely explore the possibilities. Consider also the paper-and-pen operational processes you will use during an incident, and challenge every assumption by creating an open and collaborative workshop environment.
Subscribe to our weekly Cyber Threat Intelligence Briefing via our website www.blackarrowcyber.com, and contact us to hear how we are supporting clients in various countries and sectors to manage their cyber security risks in a proportionate way.
Black Arrow Cyber Threat Intelligence Briefing 09 January 2025
Black Arrow Cyber Threat Intelligence Briefing 09 January 2026:
-2025 Proved Hackers Aren’t Slowing Down – and Neither Should You
-Ransomware Attacks Kept Climbing in 2025 as Gangs Refused to Stay Dead
-Phishing Kits Soared in Popularity Last Year as Rookie Hackers Ramped Up DIY Cyber Attacks
-Cyber Risk Trends for 2026: Building Resilience, Not Just Defences
-Cyber Risk in 2026: How Geopolitics, Supply Chains and Shadow AI Will Test Resilience
-Average Cyberattack Cost Hits $2.5M as Recovery Lags
-New Phishing Attack Impersonate as DocuSign Deploys Stealthy Malware on Windows Systems
-Phishers Exploit Office 365 Users Who Let Their Guard Down
-Dozens of Organisations Fall Victim to Infostealers After Failing to Enforce MFA
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week’s review of cyber security insights in the specialist and general media includes a look back at 2025 and a look forward to 2026, with recommended focus areas for business leaders. Last year saw an increase in attacks and a greater focus on gaining entry through employees and third parties, and exploiting insufficient controls around access management.
The escalation in risks requires business leaders in 2026 to test their resilience to a cyber attack through rehearsals of the incident response plan. From experience of running many simulations with clients across the world, we strongly recommend the rehearsal should be led by an impartial cyber and business expert to take you and your control providers, including IT, into ‘what if’ scenarios that help to flush out assumptions.
This week, we also include news on attack campaigns for you to be aware of, including fake DocuSign emails and the continued attacks on organisations that rely only on passwords to secure access.
Contact us to discuss how to reflect our threat intelligence briefing in your approach to cyber security, in an impartial and proportionate manner.
Top Cyber Stories of the Last Week
2025 Proved Hackers Aren’t Slowing Down – and Neither Should You
Cyber activity intensified in 2025, with ransomware, espionage, cryptomining and infostealers hitting manufacturing, aerospace and critical infrastructure. Attackers are moving beyond passwords to session token theft, exploiting non-human identities and AI-driven social engineering. The Jaguar Land Rover incident shows third-party compromise can cripple operations. Business leaders should prioritise a Zero Trust model, and encourage staff to pause before clicking and to verify urgent requests before acting.
Source: https://www.phonearena.com/news/2025-proved-hackers-arent-slowing-down-neither-should-you_id177153
Ransomware Attacks Kept Climbing in 2025 as Gangs Refused to Stay Dead
Ransomware victim numbers rose sharply in 2025, with thousands of organisations named on extortion sites. Law enforcement disrupted several major groups, but attackers quickly re-emerged under new brands and affiliations. Entry points increasingly involve social engineering and stolen credentials rather than technical exploits, keeping barriers to entry low. To address this, organisations should prioritise protecting credentials, staff vigilance, and testing recovery plans, recognising that law enforcement action rarely eliminates the threat of attack.
Source: https://www.theregister.com/2026/01/08/ransomware_2025_emsisoft/
Phishing Kits Soared in Popularity Last Year as Rookie Hackers Ramped Up DIY Cyber Attacks
Phishing kits are making large-scale attacks easier, with most high-volume campaigns relying on pre-built tools that support MFA bypass and evasion. QR codes and obfuscated links are increasingly used to avoid detection, enabling less skilled attackers to run sophisticated campaigns. Business leaders should focus on strengthening access controls and authentication, reducing link-clicking behaviour, and ensuring staff recognise QR and MFA-bypass lures as part of routine security awareness.
Source: https://www.itpro.com/security/phishing/phishing-as-a-service-kits-growth-2025-barracuda
Cyber Risk Trends for 2026: Building Resilience, Not Just Defences
Cyber risk in 2026 is shaped by increasingly automated, persistent and intelligent attacks; this requires business leaders to shift their focus to resilience across governance, operations, technology and people. Key pressures include AI-driven social engineering, third-party dependencies, uncertainty around quantum computing risks and geopolitical instability. Priorities include ensuring recovery readiness and clear ownership, strengthening how identity and access are managed, and rehearsing incident response that measures success by time to detect, contain and recover.
Source: https://www.securityweek.com/cyber-risk-trends-for-2026-building-resilience-not-just-defenses/
Cyber Risk in 2026: How Geopolitics, Supply Chains and Shadow AI Will Test Resilience
Geopolitical friction will amplify cyber risk in 2026 due to shifting alliances and sanctions. Employee use of AI tools that are not within the remit of the organisation’s security controls adds unmanaged risks to vulnerability management, incident response and resilience processes. Maritime logistics is a prime target, with resilient shipping relying on real-time monitoring and intelligence-led risk exposure management. Business leaders should embed AI governance and geopolitical awareness into risk planning.
Source: https://www.infosecurity-magazine.com/opinions/geopolitics-supply-chains-shadow/
Average Cyberattack Cost Hits $2.5M as Recovery Lags
A survey of 750 CISOs across the US and UK shows recovery is taking longer and costing more, with average recovery costs at $2.5M. Many organisations face days of downtime and some up to weeks. Fewer organisations now have formal cyber resilience strategies, yet boards still expect zero breaches. Leadership responses include resetting expectations, prioritising rapid recovery, and reducing time to restore operations rather than relying solely on prevention.
Source: https://www.telecomstechnews.com/news/average-cyberattack-cost-hits-2-5m-as-recovery-lags/
New Phishing Attack Impersonate as DocuSign Deploys Stealthy Malware on Windows Systems
Attackers are using fake DocuSign emails to trick staff into launching malware on Windows devices. The campaign is designed to evade common security checks and can run without obvious warning signs. Organisations should confirm their endpoint protections can detect malicious activity triggered through email links or attachments, and ensure staff treat unexpected document-signing requests with caution and verify requests via trusted channels.
Source: https://cybersecuritynews.com/new-phishing-attack-impersonate-as-docusign/
Phishers Exploit Office 365 Users Who Let Their Guard Down
Phishing attacks are increasingly exploiting misconfigured Office 365 tenants allowing attackers to spoof trusted domains and route messages in ways that evade controls. In October 2025 alone, Microsoft reported blocking over 13 million MFA-bypass phishing emails linked to an attack campaign known as Tycoon2FA. To reduce risks, ensure tenant email authentication controls are correctly configured, prioritise phishing-resistant MFA, and treat email-based password resets as a high-risk process.
Source: https://www.darkreading.com/cloud-security/phishers-exploit-office-365-users-guard-down
Dozens of Organisations Fall Victim to Infostealers After Failing to Enforce MFA
Fifty global organisations were compromised after relying on passwords alone to access cloud systems. Attackers used infostealers to harvest stored credentials, including some that were years old, and accessed cloud platforms and exfiltrated large volumes of data, including a reported 139GB from one firm. Business leaders should ensure MFA is enforced for cloud access, reduce reuse of old credentials, and monitor access logs and unusual downloads.
Governance, Risk and Compliance
The Big Risks for ’26 – Resilience key in navigating cyber landscape
Cyber Risk Trends for 2026: Building Resilience, Not Just Defenses - SecurityWeek
2025 proved hackers aren’t slowing down – and neither should you - PhoneArena
What European security teams are struggling to operationalize - Help Net Security
Average cyberattack cost hits $2.5M as recovery lags
8 things CISOs can’t afford to get wrong in 2026 | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Inside the Cyber Extortion Boom: Phishing Gangs and Crime-as-a-Service - Infosecurity Magazine
New ransomware tactics to watch out for in 2026
Ransomware on the rise: why mid-market firms are in the crosshairs - Raconteur
The Big Risks for ’26 – Resilience key in navigating cyber landscape
Two cybersecurity experts plead guilty to running ransomware operation | CSO Online
Hackers Trapped in Resecurity’s Honeypot During Targeted Attack on Employee Network
Ransomware Victims
Cyberattack slams Jaguar Land Rover sales| Cybernews
Everest claims large insurance platform Bolttech | Cybernews
Nuneaton school reopening delayed to next week after cyber attack - BBC News
Sedgwick discloses data breach after TridentLocker ransomware attack
Jaguar Land Rover sales slump sharply amid US tariffs and cyber-attack
Cressi diving gear allegedly breached by hackers | Cybernews
Covenant Health data breach after ransomware attack impacted over 478,000 people
Phishing & Email Based Attacks
Phishers Exploit Office 365 Users Who Let Their Guard Down
Inside the Cyber Extortion Boom: Phishing Gangs and Crime-as-a-Service - Infosecurity Magazine
Phishing-as-a-service kits doubled in 2025 as tactics evolve - BetaNews
International Threats: Themes for Regional Phishing Campaigns - Security Boulevard
New Phishing Attack Impersonate as DocuSign Deploys Stealthy Malware on Windows Systems
Microsoft sends warning over new type of phishing attack | Cybernews
Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign
Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins | Malwarebytes
This phishing campaign spoofs internal messages - here's what we know | TechRadar
Cybercriminals use HTML to hide QR code phishing | Cybernews
Phishing kits soared in popularity last year as rookie hackers ramped up DIY cyber attacks | IT Pro
What the Year’s Biggest Phishing Scams Reveal
Pornhub tells users to expect sextortion emails after data exposure | Malwarebytes
Hackers target Booking.com users | Cybernews
Email-first cybersecurity predictions for 2026 - Security Boulevard
Fake emails target Cardano users with remote access malware
Other Social Engineering
Hackers target Booking.com users | Cybernews
ClickFix attack uses fake Windows BSOD screens to push malware
Pornhub tells users to expect sextortion emails after data exposure | Malwarebytes
Voice cloning defenses are easier to undo than expected - Help Net Security
I Talked to Cybersecurity Experts After These LinkedIn Scams Almost Fooled Me - CNET
Fraud, Scams and Financial Crime
Why governments need to treat fraud like cyberwarfare, not customer service | CyberScoop
What the Year’s Biggest Phishing Scams Reveal
FCC finalizes new penalties for robocall violators | CyberScoop
Artificial Intelligence
AI security risks are also cultural and developmental - Help Net Security
When AI agents interact, risk can emerge without warning - Help Net Security
In 2026, Hackers Want AI: Threat Intel on Vibe Hacking & HackGPT
Security Experts Dire Warning on AI Agents in 2026
Yes, criminals are using AI to vibe-code malware • The Register
Voice cloning defenses are easier to undo than expected - Help Net Security
EU plans new AI data rules, privacy at risk| Cybernews
Europe looks to AI resilience amid growing risk
NIST Releases Preliminary Draft Cyber AI Profile
AI agents 2026's biggest insider threat: PANW security boss • The Register
Agentic AI Is an Identity Problem and CISOs Will Be Accountable for the Outcome
Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users
ChatGPT's Memory Feature Supercharges Prompt Injection
New Zero-Click Attack Lets ChatGPT User Steal Data - Infosecurity Magazine
Legacy IAM was built for humans — and AI agents now outnumber them 82 to 1 | VentureBeat
Identity becomes the 2026 battleground as AI erases trust signals | SC Media
China moves to rein in 'anthropomorphic' AI chatbots
Government demands Musk's X deals with 'appalling' Grok AI - BBC News
UK regulators swarm X after Grok generated nudes from photos • The Register
2FA/MFA
One criminal stole info from 50 orgs thanks to no MFA • The Register
Dozens of Major Data Breaches Linked to Single Threat Actor - SecurityWeek
Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass
Malware
Dozens of organizations fall victim to infostealers after failing to enforce MFA | TechRadar
Dozens of Major Data Breaches Linked to Single Threat Actor - SecurityWeek
New Phishing Attack Impersonate as DocuSign Deploys Stealthy Malware on Windows Systems
2.2M Chrome, Firefox, Edge users impacted by meeting-stealing malware | Cybernews
Infostealers Enable Attackers to Hijack Legitimate Business Infrastructure for Malware Hosting
Yes, criminals are using AI to vibe-code malware • The Register
Versatile Malware Loader pkr_mtsi Delivers Diverse Payloads - Infosecurity Magazine
Hackers target Booking.com users | Cybernews
ClickFix attack uses fake Windows BSOD screens to push malware
How attackers are weaponizing open-source package managers [Q&A] - BetaNews
GoBruteforcer Botnet Targets Linux Servers - Infosecurity Magazine
Fake emails target Cardano users with remote access malware
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Who Benefited from the Aisuru and Kimwolf Botnets? – Krebs on Security
Astaroth banking Trojan spreads in Brazil via WhatsApp worm
Bots/Botnets
The Kimwolf Botnet is Stalking Your Local Network – Krebs on Security
Kimwolf Botnet Hacked 2 Million Devices and Turned User’s Internet Connection as Proxy Node
GoBruteforcer Botnet Targets Linux Servers - Infosecurity Magazine
Who Benefited from the Aisuru and Kimwolf Botnets? – Krebs on Security
Mobile
Google fixes critical Dolby Decoder bug in Android January update
HSBC blocks app users for having sideloaded password manager • The Register
Do Smartphone Apps Spy On Your Contacts?
Denial of Service/DoS/DDoS
5 myths about DDoS attacks and protection | CSO Online
New ransomware tactics to watch out for in 2026
Internet of Things – IoT
When the Cloud Rains on Everyone's IoT Parade
Hundreds of British buses have Chinese ‘kill switch’
Data Breaches/Leaks
Experts Trace $35m in Stolen Crypto to LastPass Breach - Infosecurity Magazine
Hackers Allegedly Steal Access Tokens, Confidential Documents From European Space Agency
Hackers claim to hack Resecurity, firm says it was a honeypot
Cybercrook claims to sell critical info about utilities • The Register
NordVPN denies breach claims, says attackers have "dummy data"
Manage My Health hack: New Zealand's worst cybersecurity incidents | RNZ News
Brightspeed investigates breach as crims post data for sale • The Register
Covenant Health data breach after ransomware attack impacted over 478,000 people
Leak exposes Knownsec’s role in state cyber targeting | Cybernews
Organised Crime & Criminal Actors
Inside the Cyber Extortion Boom: Phishing Gangs and Crime-as-a-Service - Infosecurity Magazine
In 2026, Hackers Want AI: Threat Intel on Vibe Hacking & HackGPT
Billion-dollar Bitcoin hacker Ilya Lichtenstein thanks Trump for early prison release | The Verge
Alleged cybercrime kingpin arrested and extradited to China, Cambodia says | CNN
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Experts Trace $35m in Stolen Crypto to LastPass Breach - Infosecurity Magazine
Crypto wallet firm Ledger faces new data breach through Global-e partner
Billion-dollar Bitcoin hacker Ilya Lichtenstein thanks Trump for early prison release | The Verge
Coinbase insider who sold customer data to criminals arrested in India
Fake emails target Cardano users with remote access malware
Insider Risk and Insider Threats
Coinbase insider who sold customer data to criminals arrested in India
AI agents 2026's biggest insider threat: PANW security boss • The Register
Insurance
CISOs Face A Tighter Insurance Market in 2026
Supply Chain and Third Parties
Crypto wallet firm Ledger faces new data breach through Global-e partner
Cloud/SaaS
Dozens of organizations fall victim to infostealers after failing to enforce MFA | TechRadar
Cloud file-sharing sites targeted for corporate data theft attacks
When the Cloud Rains on Everyone's IoT Parade
Phishers Exploit Office 365 Users Who Let Their Guard Down
Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign
Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins | Malwarebytes
Phishing attacks exploit misconfigured emails to target Microsoft 365 - Infosecurity Magazine
Europe’s Cloud Debate Is Looking the Wrong Way: It’s Not Concentration – It’s Lock-In |
Identity and Access Management
Agentic AI Is an Identity Problem and CISOs Will Be Accountable for the Outcome
Identity becomes the 2026 battleground as AI erases trust signals | SC Media
Enterprises still aren’t getting IAM right – Computerworld
Legacy IAM was built for humans — and AI agents now outnumber them 82 to 1 | VentureBeat
Encryption
The U.K.’s Plan for Electronic Eavesdropping Poses Cybersecurity Risks | Lawfare
Linux and Open Source
GoBruteforcer Botnet Targets Linux Servers - Infosecurity Magazine
Passwords, Credential Stuffing & Brute Force Attacks
Infostealers Enable Attackers to Hijack Legitimate Business Infrastructure for Malware Hosting
Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins | Malwarebytes
Cryptocurrency theft attacks traced to 2022 LastPass breach
HSBC blocks app users for having sideloaded password manager • The Register
Palo Alto crosswalks hacked due to unchanged default passwords - Boing Boing
Social Media
I Talked to Cybersecurity Experts After These LinkedIn Scams Almost Fooled Me - CNET
Regulations, Fines and Legislation
The U.K.’s Plan for Electronic Eavesdropping Poses Cybersecurity Risks | Lawfare
EU plans new AI data rules, privacy at risk| Cybernews
Europe looks to AI resilience amid growing risk
Trump admin lifts sanctions on Predator-linked spyware execs • The Register
Uk Government's Digital ID plan is a ‘huge new cyber risk’ say Tories
Cyber security Bill will introduce mandatory digital ID by stealth, say Tories | Morning Star
Cybersecurity Act review: What to expect | Epthinktank | European Parliament
Trump pulls US out of international cyber orgs | CyberScoop
US To Leave Global Forum on Cyber Expertise - Infosecurity Magazine
Billion-dollar Bitcoin hacker Ilya Lichtenstein thanks Trump for early prison release | The Verge
China moves to rein in 'anthropomorphic' AI chatbots
Government demands Musk's X deals with 'appalling' Grok AI - BBC News
FCC finalizes new penalties for robocall violators | CyberScoop
Time to restore America’s cyberspace security system | CyberScoop
Nearly half of UK users watch unverified porn | Cybernews
Models, Frameworks and Standards
Uk Government's Digital ID plan is a ‘huge new cyber risk’ say Tories
Cyber security Bill will introduce mandatory digital ID by stealth, say Tories | Morning Star
Cybersecurity Act review: What to expect | Epthinktank | European Parliament
NIST Releases Preliminary Draft Cyber AI Profile
Careers, Roles, Skills, Working in Cyber and Information Security
Why cybersecurity cannot hire its way through the AI era | CyberScoop
The Pentagon’s short more than 20,000 cyber pros. Veterans could help fill the gap.
Cybersecurity skills matter more than headcount in the AI era | CSO Online
6 strategies for building a high-performance cybersecurity team | CSO Online
Law Enforcement Action and Take Downs
Billion-dollar Bitcoin hacker Ilya Lichtenstein thanks Trump for early prison release | The Verge
Alleged cybercrime kingpin arrested and extradited to China, Cambodia says | CNN
Two cybersecurity experts plead guilty to running ransomware operation | CSO Online
Misinformation, Disinformation and Propaganda
US, observers watch for cyber, disinformation campaigns in wake of Venezuela raid - Defense One
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
A rash of Baltic cable-cutting raises fears of sabotage
Russia Builds Underwater Drone Fleet That Could Target NATO Cables and Pipelines — UNITED24 Media
Leak exposes Knownsec’s role in state cyber targeting | Cybernews
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
What is happening to the Internet in Venezuela?
Nation State Actors
China
Leak exposes Knownsec’s role in state cyber targeting | Cybernews
New China-linked hackers breach telcos using edge device exploits
Hundreds of British buses have Chinese ‘kill switch’
China hits Taiwan with 2.6M cyberattacks a day | Cybernews
Taiwan blames Chinese ‘cyber army’ for rise in millions of daily intrusion attempts | CyberScoop
China-linked groups intensify attacks on Taiwan’s critical infrastructure, NSB warns
China moves to rein in 'anthropomorphic' AI chatbots
China’s New Cybersecurity Law Demands Faster Incident Reporting From Companies - gHacks Tech News
Congressional staff emails hacked as part of Salt Typhoon campaign | TechRadar
Russia
A rash of Baltic cable-cutting raises fears of sabotage
Russia Builds Underwater Drone Fleet That Could Target NATO Cables and Pipelines — UNITED24 Media
ClickFix attack uses fake Windows BSOD screens to push malware
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Hackers target Booking.com users | Cybernews
Starlink Satellites Might Start Falling Out Of The Sky Due To This New Threat
North Korea
North Korean hackers using QR codes to attack governments and think tanks: FBI | NK News
The Evolution of North Korea – And What To Expect In 2026 | SC Media UK
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
International Threats: Themes for Regional Phishing Campaigns - Security Boulevard
Trump suggests US used cyberattacks to turn off lights in Venezuela during strikes - POLITICO
US Action in Venezuela Provokes Cyberattack Speculation
Trump suggests US used cyberattacks to turn off lights in Venezuela during strikes - POLITICO
What is happening to the Internet in Venezuela?
US, observers watch for cyber, disinformation campaigns in wake of Venezuela raid - Defense One
Cyberattacks Likely Part of Military Operation in Venezuela
Critics pan spyware maker NSO's transparency claims amid its push to enter US market | TechCrunch
Tools and Controls
Cyber Risk Trends for 2026: Building Resilience, Not Just Defenses - SecurityWeek
Think of executive security as a must-have, not a luxury | SC Media
Logitech caused its mice to freak out by not renewing a certificate | The Verge
Security teams are paying more attention to the energy cost of detection - Help Net Security
How AI is Changing the Incident Response Landscape: What GCs Need to Know | Alston & Bird - JDSupra
The Boardroom Case for Penetration Testing - Security Boulevard
Why cybersecurity cannot hire its way through the AI era | CyberScoop
HSBC blocks app users for having sideloaded password manager • The Register
Enterprises still aren’t getting IAM right – Computerworld
Legacy IAM was built for humans — and AI agents now outnumber them 82 to 1 | VentureBeat
Yes, criminals are using AI to vibe-code malware • The Register
Legislation, loopholes, and loose ends — what does 2026 hold for the VPN industry? | TechRadar
Lack of training opening up councils to future cyber attacks - BBC News
The Role of Behavioral Analytics in Enhancing Cybersecurity Defense - Security Boulevard
Hackers claim to hack Resecurity, firm says it was a honeypot
Other News
Car brands must go back to cyber security school | Auto Express
Google tops the list of most exploited platforms in the US
Logitech caused its mice to freak out by not renewing a certificate | The Verge
Lack of training opening up councils to future cyber attacks - BBC News
Uk Government's Digital ID plan is a ‘huge new cyber risk’ say Tories
Cyber security Bill will introduce mandatory digital ID by stealth, say Tories | Morning Star
Why schools are at risk from cyber attacks | Education Business
UK government to spend £210m on public sector cyber resilience | Computer Weekly
Vulnerability Management
CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries - SecurityWeek
How attackers are weaponizing open-source package managers [Q&A] - BetaNews
Vulnerabilities
Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass
VMware ESXi zero-days likely exploited a year before disclosure
Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release
Adobe ColdFusion Servers Targeted in Coordinated Campaign - SecurityWeek
Multiple Vulnerabilities in QNAP Tools Let Attackers Obtain Secret Data
Maximum Severity “Ni8mare” Bug Lets Hackers Hijack n8n Servers - Infosecurity Magazine
Ongoing Attacks Exploiting Critical RCE Vulnerability in Legacy D-Link DSL Routers
Cisco switches hit by reboot loops due to DNS client bug
Google fixes critical Dolby Decoder bug in Android January update
Legacy D-Link routers actively exploited in the wild | Cybernews
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 02 January 2026
Black Arrow Cyber Threat Intelligence Briefing 02 January 2026:
-The Six Biggest Security Challenges Coming in 2026
-Top Sectors Under Cyber Attack in 2025
-Cyber Security Tech Recommended by Cyber Insurer Claims Data
-World Economic Forum Puts Cyber Security on Global Leadership Agenda
-Get Executives on Board with Managing Cyber Risk
-Executives Say Cyber Security Has Outgrown the IT Department
-How FOMO Is Turning AI Into a Cyber Security Nightmare
-Condé Nast Faces Major Data Breach: 2.3M WIRED Records Leaked, 40M More at Risk
-Zoom Stealer Browser Extensions Harvest Corporate Meeting Intelligence
-‘Help! I Need Money. It’s an Emergency’: Your Child’s Voicemail That Could Be a Scam
-The Changing Role of the MSP: What Does This Mean for Security?
-Customers Turn Cyber Breaches into Courtroom Battles
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
The start of a new year is an opportunity to reflect on the challenges that business leaders need to address as they help their organisations grow in a more secure environment. In this week’s review, we cover which sectors are most at risk and highlight recommended security practices based on cyber insurance claims data.
Business executives continue to rate cyber as their top risk, and we discuss the need for cyber security teams to translate risk into business impact. This week’s highlights include a large-scale campaign using malicious browser extensions to spy on online meetings, affecting over two million users. We also cover the risks of deploying AI in the business without clear controls and guardrails, and the need for business leaders to understand and manage the cyber risks associated with their managed service provider (MSP).
We help our clients take an impartial and proportionate approach to cyber security, based on an understanding of evolving risks, and support executives in leading their own cyber risk management. Contact us to discuss how we do this.
We wish you a prosperous, safe and successful 2026.
Top Cyber Stories of the Last Week
The Six Biggest Security Challenges Coming in 2026
In 2026, businesses face six major security challenges: mandated cyber resilience under new regulations, increasingly sophisticated ransomware, AI-driven phishing and vishing, heightened supply chain risks, emerging threats from agentic AI systems, and growing vulnerability backlogs as exploits accelerate. Practical steps include resilience planning, enforcing MFA, closer supplier checks, tighter controls for agentic AI, and patch prioritisation based on exploitation risk.
Source: https://www.itpro.com/security/the-six-biggest-security-challenges-coming-in-2026
Top Sectors Under Cyber Attack in 2025
A breakdown of significant cyber breaches and incidents in 2025 by industry sector highlights manufacturing ranked first for the fourth year, with finance, professional services, energy, and healthcare also heavily hit. By attack volume, education was the most targeted sector, with government/public and telecoms also seeing elevated rates. Organisations averaged nearly 2,000 weekly attacks, Europe rose by about 22%, and organisations in critical sectors accounted for about 70% of incidents.
Source: https://securityboulevard.com/2025/12/top-sectors-under-cyberattack-in-2025/
Cyber Security Tech Recommended by Cyber Insurer Claims Data
Claims data from cyber‑insurance providers show that investments in six core cyber security technologies reduce losses and influence premiums. These include role‑based access control with frequent auditing, a strong security culture, eliminating outdated legacy systems, strong MFA, zero‑trust models such as SASE, professionally managed detection and response (MDR) services, and immutable backups with restoration practice. The data also showed that payouts due to phishing now make up 49% of claims and remote‑access tools accounted for 80% of initial access vectors in direct ransomware attacks.
Source: https://www.darkreading.com/cyber-risk/cybersecurity-tech-recommended-by-cyber-insurer-claims-data
World Economic Forum Puts Cyber Security on Global Leadership Agenda
The World Economic Forum (WEF) has elevated cyber security to a global leadership priority, with its Davos Annual Meeting framing cyber risk as a top-level policy issue. Fortinet’s Derek Manky noted that the expanding organised cybercrime demands engagement from the boardroom and government, to connect technical realities to economic and geopolitical strategies. WEF attendees discussed initiatives like its Cybercrime Atlas, a bounty programme, and law enforcement/private sector partnerships.
Get Executives on Board With Managing Cyber Risk
Trend Micro’s 2025 Defenders Survey of over 3,000 security professionals shows that the single biggest improvement security teams want is clearer identification of which assets matter most, and which threats are most relevant to the business. Effective governance communication should translate technical risk into business impact, using metrics and financial terms executives understand, yet nearly half only communicate reactively or minimally, often only when required or after major developments, which risks weakening stakeholder trust.
Source: https://www.trendmicro.com/en_us/research/25/l/managing-cyber-risk-with-executives.html
Executives Say Cyber Security Has Outgrown the IT Department
A Rimini Street study finds 54% of executives rank cyber threats as the top external risk; ahead of supply chain and regulation. Organisations are integrating security into enterprise risk management, prioritising business continuity planning, and outsourcing cyber security services. Persistent staffing shortages are influencing vendor choices and driving technology investment strategies.
Source: https://www.helpnetsecurity.com/2025/12/30/rimini-street-security-leadership-strategy-report/
How FOMO Is Turning AI Into a Cyber Security Nightmare
Pressure to deploy AI quickly is pushing organisations to adopt tools before the risks are properly assessed. A 2025 incident involving Drift showed how stolen credentials and overly broad app permissions can be abused to reach data held in services such as Salesforce and Google Workspace. AI programmes need clear definitions, cross-functional risk reviews, testing for how an AI system behaves when things go wrong, tighter limits on what systems can be accessed, and human verification of outputs.
Source: https://www.inc.com/nick-selby/how-fomo-is-turning-ai-into-a-cybersecurity-nightmare/91261473
Condé Nast Faces Major Data Breach: 2.3M WIRED Records Leaked, 40M More at Risk
An attacker called “Lovely” leaked a database of 2.3M subscriber records of WIRED magazine, and threatened to release up to 40M more across Condé Nast brands. The leak includes email addresses and other account details, and includes over 102,000 home addresses.
Zoom Stealer Browser Extensions Harvest Corporate Meeting Intelligence
Researchers uncovered a large-scale campaign that uses malicious browser extensions to spy on online meetings. 2.2 million users of Chrome, Firefox, and Edge were affected. The extensions, disguised as useful tools, captured sensitive meeting details such as links, IDs, and participant information, from dozens of platforms in real time, enabling corporate espionage and targeted social engineering. The campaign was attributed to DarkSpectre, a threat actor the researchers describe as China-linked.
‘Help! I Need Money. It’s an Emergency’: Your Child’s Voicemail That Could Be a Scam
Criminal groups are using AI voice cloning to leave urgent messages that imitate a child or close family member and demand money. Very short voice samples, including clips shared online or taken from phone calls, can be sufficient to generate a usable imitation. The scam succeeds by triggering panic and urgency. Practical safeguards include pausing before responding, confirming requests via a trusted number, and agreeing family codewords in advance.
Source: https://www.theguardian.com/money/2025/dec/21/ai-cloned-voicemail-scam-criminals-fraud
The Changing Role of the MSP: What Does This Mean for Security?
Research shows 69% of managed service providers (MSPs) reported two or more breaches in the last 12 months, prompting 81% to boost specialist security hires and 78% to increase defensive spending. Customers are demanding proof of resilience, driving MSPs towards improving their ability to manage the security of their clients’ cyber and IT estates and stronger internal cyber security practices.
Source: https://www.itpro.com/security/the-changing-role-of-the-msp-what-does-this-mean-for-security
Customers Turn Cyber Breaches Into Courtroom Battles
Consumers are being recruited to join group legal actions against firms like M&S and Co‑Op after cyber breaches. Early statements from these organisations suggested there was no evidence at that point of customer data compromise, but this changed as investigations confirmed access, creating potential legal exposure. CISOs play a role in avoiding false certainty, and adopting litigation-aware communications, which should be part of the organisation’s incident management plans to manage risks.
Source: https://cybernews.com/security/customers-take-stand-cybersecurity-new-trial/
Governance, Risk and Compliance
Customers turn cyber breaches into courtroom battles | Cybernews
WEF Puts Cybersecurity on the Global Leadership Agenda
Executives say cybersecurity has outgrown the IT department - Help Net Security
Get Executives on board with managing Cyber Risk | Trend Micro (US)
Tabletop exercises look a little different this year • The Register
Forensics and Investigation Is the New Cyber Frontline - Infosecurity Magazine
The changing role of the MSP: What does this mean for security? | ChannelPro
Inside the Biggest Cyber Attacks of 2025 - Security Boulevard
Cyber attacks ‘tipping point’ warning issued after Harrods and M&S targeted | The Independent
CISOs are managing risk in survival mode - Help Net Security
Top Sectors Under Cyberattack in 2025 - Security Boulevard
The six biggest security challenges coming in 2026 | IT Pro
Security coverage is falling behind the way attackers behave - Help Net Security
New Tech Deployments That Cyber Insurers Recommend for 2026
Cyber attacks: 2025 the ‘tipping point’ as JLR and M&S incidents highlight risks | The Standard
Building resilient teams in cyberdefense | Opinion | Compliance Week
Europe has ‘lost the internet’, warns Belgium’s cyber security chief
Threats
Ransomware, Extortion and Destructive Attacks
Security coverage is falling behind the way attackers behave - Help Net Security
Former US cybersecurity professionals plead guilty to BlackCat/ALPHV attacks - SiliconANGLE
Web Browsing’s Dark Side: Understanding Ransomware over Modern Web Browsers - Security Boulevard
Ransomware’s new playbook is chaos - Help Net Security
The biggest cybersecurity and cyberattack stories of 2025
Customers turn cyber breaches into courtroom battles | Cybernews
An arrest has been made in the Coinbase ransomware breach | Mashable
How the UK Retail Sector Responded to the Scattered Spider Hack Wave - Infosecurity Magazine
Feds are hunting teenage hackers | Fortune
Ransomware Victims
Crims punish Wired subscribers by publishing personal info • The Register
How the human harms of cybercrime shook the world in 2025 • The Register
Romania’s Oltenia Energy Complex suffers major ransomware attack
The Worst Hacks of 2025 | WIRED
An arrest has been made in the Coinbase ransomware breach | Mashable
Phishing & Email Based Attacks
Security coverage is falling behind the way attackers behave - Help Net Security
Yet another phishing campaign impersonates trusted Google services - here's what we know | TechRadar
Fake GrubHub emails promise tenfold return on sent cryptocurrency
Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware
Other Social Engineering
New ErrTraffic service enables ClickFix attacks via fake browser glitches
Insight: A scammer's guide: How cybercriminals plot to rob a target in a week | Reuters
What is Vishing? - Security Boulevard
Fraud, Scams and Financial Crime
Insight: A scammer's guide: How cybercriminals plot to rob a target in a week | Reuters
Nationwide hit with record fine after failing to spot customer’s £27m Covid fraud
LLMs are automating the human part of romance scams - Help Net Security
2025’s crypto criminals: Making bank while cutting off fingers
Fake GrubHub emails promise tenfold return on sent cryptocurrency
Korean telco failed at femtocell security, exposed customers • The Register
Artificial Intelligence
Security coverage is falling behind the way attackers behave - Help Net Security
LLMs are automating the human part of romance scams - Help Net Security
Critical Langchain Vulnerability Let attackers Exfiltrate Sensitive Secrets from AI systems
Fighting AI with AI: The Rise of Multi-LLM Orchestrated Cyber Attacks - Security Boulevard
2026 Year of the Worm? AI Is Fueling a Malware Comeback
Widely Used Malicious Extensions Steal ChatGPT, DeepSeek Conversations - Security Boulevard
How FOMO Is Turning AI Into a Cybersecurity Nightmare
The AI balancing act your company can't afford to fumble in 2026 | ZDNET
Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors
AI Browsers the New Trojan Horse? - GovInfoSecurity
OpenAI says prompt injection may never be ‘solved’ for browser agents like Atlas | CyberScoop
Can one state save us from AI disaster? Inside California's new legislative crackdown | ZDNET
As Coders Adopt AI Agents, Security Pitfalls Lurk in 2026
Contrarians No More: AI Skepticism Is on the Rise
AML/CFT/Money Laundering/Terrorist Financing/Sanctions
Ship seized in Finland suspected of cable damage was carrying sanctioned Russian steel | Euronews
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
UK law firms get ready for crackdown on money laundering | Financial sector | The Guardian
Malware
Zoom Stealer browser extensions harvest corporate meeting intelligence
DarkSpectre Hackers Infected 8.8 Million Chrome, Edge, and Firefox Users with Malware
2026 Year of the Worm? AI Is Fueling a Malware Comeback
China-Linked Evasive Panda Ran DNS Poisoning Campaign to Deliver MgBot Malware
MacSync Stealer malware bypasses macOS Gatekeeper security warnings | CSO Online
React2Shell under attack: RondoDox Botnet spreads miners and malware
New GlassWorm malware wave targets Macs with trojanized crypto wallets
Security Bite: A note on the growing problem of Apple-notarized malware on macOS - 9to5Mac
Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor
The next cyber battlefield: Preparing federal networks for autonomous malware
Bots/Botnets
React2Shell under attack: RondoDox Botnet spreads miners and malware
RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers
Denial of Service/DoS/DDoS
Pro-Russian group Noname057 claims cyberattack on La Poste services
Internet of Things – IoT
RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers
Top tips to protect your Christmas gifts from cyber-scrooges - GOV.UK
Estonia's cybersecurity authority perceives Chinese drones as major risk | News | ERR
The FCC has probably killed a plan to improve smart home security | The Verge
New York’s incoming mayor bans Raspberry Pi at inauguration • The Register
Data Breaches/Leaks
Customers turn cyber breaches into courtroom battles | Cybernews
Crims punish Wired subscribers by publishing personal info • The Register
The biggest cybersecurity and cyberattack stories of 2025
Condé Nast faces major data breach: 2.3M WIRED records leaked, 40M more at risk
Stolen LastPass backups enable crypto theft through 2025
Sensitive data 'likely taken' in Westminster council cyber attack - BBC News
The Worst Hacks of 2025 | WIRED
Aflac confirms June data breach affecting over 22 million customers
Accused data thief dumped laptop in river to evade justice • The Register
Disney will pay $10 million to settle children's data privacy lawsuit
Korean telco failed at femtocell security, exposed customers • The Register
Korean Air discloses data breach after the hack of its catering and duty-free supplier
Coupang to split $1.17 billion among 33.7 million data breach victims
Apple Got Hacked? - Massive Cyberattack May Have Leaked Sensitive Data from iPhone Maker | IBTimes
European Space Agency confirms breach of "external servers"
French campuses got hacked, attackers claim | Cybernews
Organised Crime & Criminal Actors
2025’s crypto criminals: Making bank while cutting off fingers
How the human harms of cybercrime shook the world in 2025 • The Register
Accused data thief dumped laptop in river to evade justice • The Register
Insight: A scammer's guide: How cybercriminals plot to rob a target in a week | Reuters
Feds are hunting teenage hackers | Fortune
Hacker Who Stole Millions in Seconds Finally Caught – DataBreaches.Net
Illegal streaming grew into an organized, profitable, and dangerous industry - Help Net Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
2025’s crypto criminals: Making bank while cutting off fingers
How the human harms of cybercrime shook the world in 2025 • The Register
Stolen LastPass backups enable crypto theft through 2025
React2Shell under attack: RondoDox Botnet spreads miners and malware
New GlassWorm malware wave targets Macs with trojanized crypto wallets
Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist - SecurityWeek
An arrest has been made in the Coinbase ransomware breach | Mashable
Hackers drain $3.9M from Unleash Protocol after multisig hijack
Fake GrubHub emails promise tenfold return on sent cryptocurrency
Insurance
New Tech Deployments That Cyber Insurers Recommend for 2026
Supply Chain and Third Parties
The changing role of the MSP: What does this mean for security? | ChannelPro
Korean Air discloses data breach after the hack of its catering and duty-free supplier
Apple Got Hacked? - Massive Cyberattack May Have Leaked Sensitive Data from iPhone Maker | IBTimes
Cloud/SaaS
AI killed the cloud-first strategy: Why hybrid computing is the only way forward now | ZDNET
Airbus to migrate critical apps to a sovereign Euro cloud • The Register
Encryption
Stolen LastPass backups enable crypto theft through 2025
Passwords, Credential Stuffing & Brute Force Attacks
How to Prevent Credential Stuffing Attacks: Detection & Protection Strategies - Security Boulevard
Social Media
1 in 5 YouTube Shorts is AI slop now - and Americans are eating it up | ZDNET
Regulations, Fines and Legislation
The FCC has probably killed a plan to improve smart home security | The Verge
Can one state save us from AI disaster? Inside California's new legislative crackdown | ZDNET
Fears Mount That US Federal Cybersecurity Is Stagnating—or Worse | WIRED
Models, Frameworks and Standards
Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors
Data Protection
What consumers expect from data security - Help Net Security
Careers, Roles, Skills, Working in Cyber and Information Security
Building resilient teams in cyberdefense | Opinion | Compliance Week
Mentorship & Diversity: Shaping the Next Gen of Cyber Experts
The Modern Cyber Workforce | AFCEA International
What Kevin Bacon Can Teach You About Cybersecurity Careers
Law Enforcement Action and Take Downs
Former US cybersecurity professionals plead guilty to BlackCat/ALPHV attacks - SiliconANGLE
Accused data thief dumped laptop in river to evade justice • The Register
Feds are hunting teenage hackers | Fortune
Hacker Who Stole Millions in Seconds Finally Caught – DataBreaches.Net
An arrest has been made in the Coinbase ransomware breach | Mashable
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Cyberwarfare is here – and we must be ready
New German military plan views foreign sabotage as preparation for war – POLITICO
It’s not just Taiwan... Five flashpoints that could spark World War Three in 2026 | The Independent
Navy’s fleet of 4ft boats to protect Britain from Putin
Russian submarine followed spy ship into British waters
Hacking space: Europe ramps up security of satellites – POLITICO
Nation State Actors
China
DarkSpectre Hackers Infected 8.8 Million Chrome, Edge, and Firefox Users with Malware
Chinese state hackers plant malware inside Windows | Cybernews
Cyberhackers Just Turned 150 Browser Extensions Into Viruses - Here's How
It’s not just Taiwan... Five flashpoints that could spark World War Three in 2026 | The Independent
China-Linked Evasive Panda Ran DNS Poisoning Campaign to Deliver MgBot Malware
Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor
Estonia's cybersecurity authority perceives Chinese drones as major risk | News | ERR
MongoBleed (CVE-2025-14847): the US, China, and the EU are among the top exploited GEOs
Russia
New German military plan views foreign sabotage as preparation for war – POLITICO
It’s not just Taiwan... Five flashpoints that could spark World War Three in 2026 | The Independent
Navy’s fleet of 4ft boats to protect Britain from Putin
Russian submarine followed spy ship into British waters
Pro-Russian group Noname057 claims cyberattack on La Poste services
Ship seized in Finland suspected of cable damage was carrying sanctioned Russian steel | Euronews
Finland detains ship and its crew after critical undersea cable damaged | CNN
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
You've been targeted by government spyware. Now what? | TechCrunch
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
Tools and Controls
DarkSpectre Hackers Infected 8.8 Million Chrome, Edge, and Firefox Users with Malware
Cyberhackers Just Turned 150 Browser Extensions Into Viruses - Here's How
Forensics and Investigation Is the New Cyber Frontline - Infosecurity Magazine
New Tech Deployments That Cyber Insurers Recommend for 2026
Cybersecurity’s AI Arms Race Is Just Getting Started—Here’s What 2026 Will Bring - ClearanceJobs
Fighting AI with AI: The Rise of Multi-LLM Orchestrated Cyber Attacks - Security Boulevard
Widely Used Malicious Extensions Steal ChatGPT, DeepSeek Conversations - Security Boulevard
How FOMO Is Turning AI Into a Cybersecurity Nightmare
Web Browsing’s Dark Side: Understanding Ransomware over Modern Web Browsers - Security Boulevard
Tabletop exercises look a little different this year • The Register
"Military-grade encryption" is meaningless: decoding VPN buzzwords | Tom's Guide
AI killed the cloud-first strategy: Why hybrid computing is the only way forward now | ZDNET
AI Browsers the New Trojan Horse? - GovInfoSecurity
OpenAI says prompt injection may never be ‘solved’ for browser agents like Atlas | CyberScoop
Windows Event Logs Reveal the Messy Reality Behind 'Sophisticated' Cyberattacks
Reports Published in the Last Week
Other News
"Military-grade encryption" is meaningless: decoding VPN buzzwords | Tom's Guide
Windows Event Logs Reveal the Messy Reality Behind 'Sophisticated' Cyberattacks
Europe has ‘lost the internet’, warns Belgium’s cyber security chief
Remedio CEO: If you don't think like a hacker, you won't win • The Register
When One Vulnerability Breaks the Internet and Millions of Devices Join In - Security Boulevard
These are the cybersecurity stories we were jealous of in 2025 | TechCrunch
Top Sectors Under Cyberattack in 2025 - Security Boulevard
Hacking space: Europe ramps up security of satellites – POLITICO
Radio signals could give attackers a foothold inside air-gapped devices - Help Net Security
British hacker wins visa by infiltrating Australian government website
Vulnerability Management
2025 marks a breakout year for zero-day exploits| Cybernews
Vulnerabilities
RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers
React2Shell under attack: RondoDox Botnet spreads miners and malware
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
MongoBleed (CVE-2025-14847): the US, China, and the EU are among the top exploited GEOs
'Heartbleed of MongoDB' under active exploit • The Register
Fortinet warns of 5-year-old FortiOS 2FA bypass still exploited in attacks
Critical Langchain Vulnerability Let attackers Exfiltrate Sensitive Secrets from AI systems
Critical Zero-Day RCE Flaw in Networking Devices Exposes Over 70,000 Hosts
When One Vulnerability Breaks the Internet and Millions of Devices Join In - Security Boulevard
Critical CVSS 9.8 Flaw Found in IBM API Connect Authentication System
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 26 December 2025
Black Arrow Cyber Threat Intelligence Briefing 26 December 2025:
-Why Hackers Love the Holidays
-Threat Actors Are Hiring Insiders in Banks, Telecoms, and Tech from $3,000 to $15,000 for Access or Data
-Watch Out - Hackers Are Coming After Your Christmas Bonus, as Paychecks Come Under Threat
-Scripted Sparrow Sends Millions of BEC Emails Each Month
-Cybercriminals Flock to a New Unrestricted AI Tool: 10,000 Prompts on the First Day
-Think You Can Beat Ransomware? RansomHouse Just Made It a Lot Harder
-Why Businesses Can No Longer Treat Cyber Security as an IT Problem
-Cyberattack Disrupts France’s Postal Service and Banking During Christmas Rush
-Ministers Confirm Breach at UK Foreign Office but Details Remain Murky
-The NCSC’s Warning to UK Firms: How to Boost Incident Response
-From AI to Cyber Risk, Why IT Leaders Are Anxious Heading into 2026
-Cyber Security Budgets Are Going Up
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week we present insights for business leaders assessing their cyber security controls and practices. Attackers exploit the holiday period when security staff are on leave, while others entice employees to provide unauthorised access to their employer’s systems. We also include developments in business email compromise and research findings on the entry point of malware.
Looking to 2026, the UK’s NCSC warns organisations to be prepared to manage a cyber incident, and business leaders have expressed concern about their cyber security especially in the context of AI, while many are planning to increase their cyber security budgets.
Our recommendation for 2026 is for business leaders to take an informed and objective assessment of their risks, and to check that the cyber security controls in place do indeed address those risks. Business leaders are not expected to be cyber security experts, but they should have a firm grip of the fundamentals to take command of their own security. Contact us to discuss how to do this in a proportionate way.
Thank you for reading our weekly summaries, and we wish you a secure and prosperous 2026.
Top Cyber Stories of the Last Week
Why Hackers Love the Holidays
Attackers often target organisations between Christmas and New Year because offices are quieter and security staffing is reduced. A Semperis survey reported that 52% of ransomware attacks in the last year occurred on a weekend or holiday, and 78% of organisations said they reduce security staff over the holidays. Phishing, ransomware and data theft are common holiday-period tactics, with some intrusions not discovered until weeks later.
Source: https://www.axios.com/2025/12/25/holidays-hackers-corporate-security-teams
Threat Actors Are Hiring Insiders in Banks, Telecoms, and Tech from $3,000 to $15,000 for Access or Data
Threat actors are recruiting employees at banks, telecoms and tech firms via darknet forums to obtain access or data. Offers range from $3,000 to $15,000 and include requests for access to corporate networks, devices, and cloud systems. This approach is positioned as an alternative to attacking a range of organisations and sectors from the outside through brute force attacks or social engineering.
Source: https://cybersecuritynews.com/threat-actors-are-hiring-insiders-in-banks-telecoms/
Watch Out - Hackers Are Coming After Your Christmas Bonus, as Paychecks Come Under Threat
Attackers are targeting payroll and end-of-year payments by calling corporate help desks and impersonating employees to trigger password resets or account changes. The goal is to alter details, so salary payments are redirected. Mitigations include stronger identity verification by support staff, avoiding authentication-factor changes on request, and limiting access to sensitive applications with extra scrutiny for unusual logins.
Scripted Sparrow Sends Millions of BEC Emails Each Month
A business email compromise (BEC) group dubbed Scripted Sparrow is sending an estimated 4 to 6 million bespoke emails per month, posing as executive coaching firms and targeting Accounts Payable teams with spoofed reply chains and invoice-style PDFs. Researchers linked the group to 119 domains, 245 webmail addresses and 256 bank accounts. Recommended actions for organisations include enforcing payment approval steps for all invoices and verifying requests via official internal channels.
Source: https://www.infosecurity-magazine.com/news/scripted-sparrow-millions-bec-each/
Cybercriminals Flock to a New Unrestricted AI Tool: 10,000 Prompts on the First Day
A new AI tool with few built-in safeguards has been found freely available on the dark web. The operators of the tool, called DIG AI, claimed it received 10,000 prompts in the first 24 hours. A security firm reported that testing found it would respond to prompts linked to fraud and creating malicious software.
Source: https://cybernews.com/security/dig-ai-new-cyber-weapon-abused-by-hackers/
Think You Can Beat Ransomware? RansomHouse Just Made It a Lot Harder
RansomHouse is a cyber extortion group that steals sensitive data and extorts money to prevent publication on a leak site. The group has recently added measures that complicate analysis during an incident and can limit the ability to recover without paying. The group introduced a multi-layered encryption update to its double-extortion ransomware-as-a-service (RaaS) model that can hinder incident response timelines and negotiating strategies. Organisations are advised to prioritise behavioural analytics, real-time monitoring, hardened segmentation, and regular backup validation.
Why Businesses Can No Longer Treat Cyber Security as an IT Problem
Cyber security risk is increasingly driven by user behaviour, with research by OpenText finding that over a third of consumer malware is first spotted in the Downloads directory, where users routinely save invoices, installers and documents. These files can look harmless initially, then later pull in ransomware or credential-stealing payloads. AI is also making scams harder to spot by removing the usual warning signs, and deepfakes are being used to approve high-value deals. Security teams are advised to shift from content scanning to behaviour monitoring, unify identity, data and threat signals, and use AI to triage alerts faster.
Cyberattack Disrupts France’s Postal Service and Banking During Christmas Rush
A distributed denial of service (DDoS) attack disrupted France’s national postal service shortly before Christmas, making online services inaccessible and impacting package tracking and online payments. The organisation stated customer data was not affected, but the incident also disrupted its banking arm’s payment approvals, forcing workarounds.
Ministers Confirm Breach at UK Foreign Office but Details Remain Murky
UK ministers confirmed there has been a cyberattack affecting the Foreign Office, with officials stating the investigation began in October and that further detail, including attribution, remains unconfirmed. Media reporting referenced a possible China link and visa-application related data, but ministers did not confirm and said early findings suggest low risk of harm to individuals.
Source: https://www.theregister.com/2025/12/19/uk_foreign_office_hack/
The NCSC’s Warning to UK Firms: How to Boost Incident Response
The UK National Cyber Security Centre (NCSC) is urging organisations to keep incident response plans available offline, including physical copies, because cyberattacks can remove access to email, shared drives, and collaboration tools. Its 2025 Annual Review data shows 429 incidents handled in the first nine months of 2025, with nearly half classed as “nationally significant” versus 89 the year before. The guidance emphasises resilience through offline communications options, tested backups, business leadership preparation, and regular simulation exercises.
Source: https://insight.scmagazineuk.com/the-ncscs-warning-to-uk-firms-how-to-boost-incident-response
From AI to Cyber Risk, Why IT Leaders Are Anxious Heading into 2026
A Veeam survey of 250 senior IT and business decision-makers put cyber security threats as the top expected disruptor for 2026, with nearly half naming security incidents as their main concern. Around 66% ranked AI-generated attacks as the biggest data threat, while roughly half highlighted ransomware. As cloud and Software as a Service (SaaS) spreads, 60% said visibility of where data sits has declined, and only about 29% felt very confident recovering after a zero-day exploit.
Source: https://www.helpnetsecurity.com/2025/12/26/it-planning-cybersecurity-threats-2026/
Cyber Security Budgets Are Going Up
A 2025 KPMG survey found 99% of security leaders plan to increase cyber security budgets over the next two to three years, with 54% expecting increases of 6% to 10%. More than half reported competing internally for funding. Artificial Intelligence (AI) is highlighted as both a driver of risk and investment, with 38% citing AI-powered attacks as a challenge, and organisations reporting use of AI for fraud prevention and detection while skills gaps remain a constraint.
Source: https://securityboulevard.com/2025/12/cybersecurity-budgets-are-going-up-pointing-to-a-boom/
Governance, Risk and Compliance
Cybersecurity Budgets are Going Up, Pointing to a Boom - Security Boulevard
The NCSC’s Warning To UK Firms: How To Boost Incident Response | SC Media UK
Why businesses can no longer treat cybersecurity as an IT problem - The Economic Times
From AI to cyber risk, why IT leaders are anxious heading into 2026 - Help Net Security
Invest in cybersecurity before it's too late - Verdict
What CISOs should know about the SolarWinds lawsuit dismissal | CSO Online
UK CEOs Expect AI, Cyberattacks and Cost Cuts to Dominate 2026
Threats
Ransomware, Extortion and Destructive Attacks
Think you can beat ransomware? RansomHouse just made it a lot harder | CSO Online
RansomHouse upgrades encryption with multi-layered data processing
Former incident responders plead guilty to ransomware attack spree | CyberScoop
Interpol-led action decrypts 6 ransomware strains, arrests hundreds
Ukrainian national pleads guilty to Nefilim ransomware attacks | CyberScoop
Top Ransomware Trends of 2025 - Infosecurity Magazine
Best of 2025: New Akira Ransomware Decryptor Leans on Nvidia GPU Power - Security Boulevard
Ransomware’s New Frontier: How Universities Can Defend Against This Growing Threat | EdTech Magazine
CISA loses key employee behind early ransomware warnings – DataBreaches.Net
Ransomware Victims
‘Sensitive’ data stolen in Westminster City Council cyber attack | Computer Weekly
Club Atlético River Plate ransomware attack | Cybernews
Phishing & Email Based Attacks
Scripted Sparrow BEC Group Sends Millions of Emails Each Month - Infosecurity Magazine
Surge of OAuth Device Code Phishing Attacks Targets M365 Accounts - Security Boulevard
Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers
Five Phishing Red Flags to Remember This Holiday Season - Security Boulevard
US shutters phisherfolk’s $14.6M password-hoarding platform • The Register
Nigeria arrests dev of Microsoft 365 'Raccoon0365' phishing platform
Microsoft's The Top Brand Scammers Use When Phishing For Clicks, Study Shows
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Scripted Sparrow BEC Group Sends Millions of Emails Each Month - Infosecurity Magazine
Other Social Engineering
Scripted Sparrow BEC Group Sends Millions of Emails Each Month - Infosecurity Magazine
Amazon confirms years-long Russian cyberattack against AWS customers' devices | Mashable
Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread - Security Boulevard
86% Surge in Fake Delivery Websites Hits Shoppers During Holiday Rush - Infosecurity Magazine
Elusive MI6 wannabe must repay £125k to romance scam victim • The Register
Nomani Investment Scam Surges 62% Using AI Deepfake Ads on Social Media
Coordinated Scams Target MENA Region With Fake Online Job Ads - Infosecurity Magazine
Microsoft's The Top Brand Scammers Use When Phishing For Clicks, Study Shows
Fraud, Scams and Financial Crime
86% Surge in Fake Delivery Websites Hits Shoppers During Holiday Rush - Infosecurity Magazine
US Charges 54 in Massive ATM Jackpotting Conspiracy - Infosecurity Magazine
SEC Charges Crypto Firms in $14m Investment Scam - Infosecurity Magazine
Elusive MI6 wannabe must repay £125k to romance scam victim • The Register
Consumer Cyber Risks in 2026 Focus on AI-Driven Scams, Not Hacks - gHacks Tech News
South Korea to require face scans to buy a SIM • The Register
Identity Fraud Among Home Care Workers Puts Patients at Risk
Greater Manchester Police sackings over homeworking 'key jamming' - BBC News
Artificial Intelligence
From AI to cyber risk, why IT leaders are anxious heading into 2026 - Help Net Security
Cybercriminals flock to new unrestricted AI tool | Cybernews
Browser agents don't always respect your privacy choices - Help Net Security
When AI Becomes a Weapon: Former Senior Intelligence Executive Reveals Beijing's CyberWar Playbook
Consumer Cyber Risks in 2026 Focus on AI-Driven Scams, Not Hacks - gHacks Tech News
Nomani Investment Scam Surges 62% Using AI Deepfake Ads on Social Media
UK CEOs Expect AI, Cyberattacks and Cost Cuts to Dominate 2026
FBI says ‘ongoing’ deepfake impersonation of U.S. gov officials dates back to 2023 | CyberScoop
Pen testers accused of 'blackmail' over Eurostar AI flaws • The Register
AML/CFT/Money Laundering/Terrorist Financing/Sanctions
US Shuts Down Crypto Exchange E-Note, Charges Russian Administrator - SecurityWeek
FBI Disrupts Russian Crypto Laundering Hub Enabling Cybercrime - Infosecurity Magazine
2FA/MFA
One-time codes used to hack corporate accounts | CSO Online
Malware
Why businesses can no longer treat cybersecurity as an IT problem - The Economic Times
MacSync macOS Malware Distributed via Signed Swift Application - SecurityWeek
Budding infosec pros and aspiring cyber crooks targeted with fake PoC exploits - Help Net Security
North Korean Beavertail malware sparks attacks across financial sector | SC Media
Fake MAS Windows activation domain used to spread PowerShell malware
WebRAT malware spread via fake vulnerability exploits on GitHub
Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours
Threat Actors Advertised NtKiller Malware on Dark Web Claiming Terminate Antivirus and EDR Bypass
Cracked Software and YouTube Videos Spread CountLoader and GachiLoader Malware
ATM jackpotting gang accused of unleashing Ploutus malware • The Register
Bots/Botnets
Massive Android botnet Kimwolf infects millions, strikes with DDoS
DDoS Protection Faces Fresh Challenges As Bot Traffic Reaches New Peak - IT Security Guru
Mobile
Android Attacks—Google Confirms No Fix For 30% Of All Phones
A new Android Trojan can hide inside apps you trust — and this is how it gets to you - PhoneArena
Three things they’re not telling you about mobile app security - SD Times
Android Malware Operations Merge Droppers, SMS Theft, and RAT Capabilities at Scale
South Korea to require face scans to buy a SIM • The Register
Apple and Google allow alternative app stores in Japan • The Register
Uzbek Users Under Attack by Android SMS Stealers
Denial of Service/DoS/DDoS
Massive Android botnet Kimwolf infects millions, strikes with DDoS
DDoS Protection Faces Fresh Challenges As Bot Traffic Reaches New Peak - IT Security Guru
Cyberattack Disrupts France's Postal Service and Banking During Christmas Rush - SecurityWeek
Pro-Russian hackers claim French postal service cyberattack | Euronews
Wave of cyberattacks expose French failure to protect public digital systems
Internet of Things – IoT
Massive Android botnet Kimwolf infects millions, strikes with DDoS
When everything connects, everything’s at risk | ChannelPro
NIST issues guidance on securing smart speakers - Help Net Security
Intruders Can Use Wi-Fi Jammers To Evade Your Home Security - Here's How
Raspberry Pi used in attempt to take over ferry | CSO Online
Data Breaches/Leaks
Hackers stole data in UK government cyberattack, minister confirms | TechRadar
Britain suspects China of involvement in cyberattack on Foreign Office | УНН
China-backed hacker group Storm 1849 accused of UK government cyber attack - Cryptopolitan
Hacks, thefts, and disruption: The worst data breaches of 2025 | TechCrunch
Minister Confirms UK Foreign Office Hacked | Silicon UK
LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds
LastPass Agrees to Reimburse Crypto in Data Breach Settlement
Coupang breach affecting 33.7 million users raises data protection questions
South Korean firm hit with US investor lawsuit over data breach disclosure failures | CSO Online
‘Sensitive’ data stolen in Westminster City Council cyber attack | Computer Weekly
UK: NHS Supplier Confirms Cyber-Attack, Operations Unaffected - Infosecurity Magazine
3.5 Million Affected by University of Phoenix Data Breach - SecurityWeek
Nissan says thousands of customers exposed in Red Hat breach
Coupang says all leaked customer information in data breach has been deleted | The Straits Times
Organised Crime & Criminal Actors
Cybercriminals flock to new unrestricted AI tool | Cybernews
Cybersecurity teams prep for an influx of attacks over the holidays
US Charges 54 in Massive ATM Jackpotting Conspiracy - Infosecurity Magazine
US Shuts Down Crypto Exchange E-Note, Charges Russian Administrator - SecurityWeek
FBI Disrupts Russian Crypto Laundering Hub Enabling Cybercrime - Infosecurity Magazine
574 arrests and USD 3 million recovered in coordinated cybercrime operation across Africa
FBI seized ‘web3adspanels.org’ hosting stolen logins
Nigeria arrests dev of Microsoft 365 'Raccoon0365' phishing platform
Leader of 764 offshoot pleads guilty, faces up to 60 years in jail | CyberScoop
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds
LastPass Agrees to Reimburse Crypto in Data Breach Settlement
US Shuts Down Crypto Exchange E-Note, Charges Russian Administrator - SecurityWeek
FBI Disrupts Russian Crypto Laundering Hub Enabling Cybercrime - Infosecurity Magazine
Insider Risk and Insider Threats
They are offering up to $15k reward for betraying your boss | Cybernews
Supply Chain and Third Parties
Amazon confirms years-long Russian cyberattack against AWS customers' devices | Mashable
Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread - Security Boulevard
UK: NHS Supplier Confirms Cyber-Attack, Operations Unaffected - Infosecurity Magazine
Nissan says thousands of customers exposed in Red Hat breach
Software Supply Chain
WebRAT malware spread via fake vulnerability exploits on GitHub
Cloud/SaaS
Amazon confirms years-long Russian cyberattack against AWS customers' devices | Mashable
Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread - Security Boulevard
Microsoft confirms Teams is down and messages are delayed
Cloud security is stuck in slow motion - Help Net Security
Outages
Microsoft confirms Teams is down and messages are delayed
The year the cloud went dark: Inside 2025’s biggest tech outages - The Economic Times
Identity and Access Management
The next big IT security battle is all about privileged access - Help Net Security
Five identity-driven shifts reshaping enterprise security in 2026 - Help Net Security
Encryption
Creating apps like Signal or WhatsApp could be 'hostile activity,' claims UK watchdog | TechRadar
Linux and Open Source
Arch Linux Website Hit by DDoS and Temporarily Limited to IPv6
Passwords, Credential Stuffing & Brute Force Attacks
Malicious extensions in Chrome Web store steal user credentials
Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites
US shutters phisherfolk’s $14.6M password-hoarding platform • The Register
NIS2 Compliance: Maintaining Credential Security - Security Boulevard
Social Media
Nomani Investment Scam Surges 62% Using AI Deepfake Ads on Social Media
Cracked Software and YouTube Videos Spread CountLoader and GachiLoader Malware
Regulations, Fines and Legislation
South Korean firm hit with US investor lawsuit over data breach disclosure failures | CSO Online
SEC Charges Crypto Firms in $14m Investment Scam - Infosecurity Magazine
What CISOs should know about the SolarWinds lawsuit dismissal | CSO Online
CISA loses key employee behind early ransomware warnings – DataBreaches.Net
Trump formally taps Joshua Rudd to lead NSA, Cyber Command - Nextgov/FCW
2025 reshaped federal cybersecurity, from new mandates to tougher compliance rules
Industry Continues to Push Back on HIPAA Security Rule Overhaul
Head of the US Cyber Security Agency Fails Polygraph Test and Fires Subordinates - Militarnyi
Models, Frameworks and Standards
NIS2 Compliance: Maintaining Credential Security - Security Boulevard
Creating apps like Signal or WhatsApp could be 'hostile activity,' claims UK watchdog | TechRadar
NIST, MITRE announce $20 million research effort on AI cybersecurity | CyberScoop
Britain’s Online Safety Act is reshaping the internet without America’s consent
Industry Continues to Push Back on HIPAA Security Rule Overhaul
NIST issues guidance on securing smart speakers - Help Net Security
Weak enforcement keeps PCI DSS compliance low - Help Net Security
Data Protection
Coupang breach affecting 33.7 million users raises data protection questions
Careers, Roles, Skills, Working in Cyber and Information Security
Building cyber talent through competition, residency, and real-world immersion - Help Net Security
Cybersecurity Interviews Are Risk Assessments in Disguise
Law Enforcement Action and Take Downs
US Shuts Down Crypto Exchange E-Note, Charges Russian Administrator - SecurityWeek
574 arrests and USD 3 million recovered in coordinated cybercrime operation across Africa
Interpol-led action decrypts 6 ransomware strains, arrests hundreds
Former incident responders plead guilty to ransomware attack spree | CyberScoop
US shutters phisherfolk’s $14.6M password-hoarding platform • The Register
FBI seized ‘web3adspanels.org’ hosting stolen logins
Nigeria arrests dev of Microsoft 365 'Raccoon0365' phishing platform
Leader of 764 offshoot pleads guilty, faces up to 60 years in jail | CyberScoop
Elusive MI6 wannabe must repay £125k to romance scam victim • The Register
Ukrainian national pleads guilty to Nefilim ransomware attacks | CyberScoop
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
The cyberwarfare landscape is changing — here’s how to prepare - Nextgov/FCW
German intelligence may be allowed to conduct cyberattacks and sabotage outside the country | УНН
Nation State Actors
CRINK attacks: which nation state hackers will be the biggest threat in 2026? | IT Pro
China
Hackers stole data in UK government cyberattack, minister confirms | TechRadar
Britain suspects China of involvement in cyberattack on Foreign Office | УНН
China-backed hacker group Storm 1849 accused of UK government cyber attack - Cryptopolitan
CRINK attacks: which nation state hackers will be the biggest threat in 2026? | IT Pro
When AI Becomes a Weapon: Former Senior Intelligence Executive Reveals Beijing's CyberWar Playbook
China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager
US adds new models of DJI and other foreign drones to national security risk list | The Independent
FCC Bans Foreign-Made Drones and Key Parts Over U.S. National Security Risks
Russia
CRINK attacks: which nation state hackers will be the biggest threat in 2026? | IT Pro
Amazon confirms years-long Russian cyberattack against AWS customers' devices | Mashable
Russia-Linked Hackers Use Microsoft 365 Device Code Phishing for Account Takeovers
UK cannot ignore deep-sea threat from Russia, head of Navy warns
German intelligence may be allowed to conduct cyberattacks and sabotage outside the country | УНН
Pro-Russian hackers claim French postal service cyberattack | Euronews
Belgian institutions reportedly hit by cyberattacks linked to pro-Russian hackers
US Shuts Down Crypto Exchange E-Note, Charges Russian Administrator - SecurityWeek
FBI Disrupts Russian Crypto Laundering Hub Enabling Cybercrime - Infosecurity Magazine
Starlink in the crosshairs: How Russia could attack Elon Musk's conquering of space
Iran
CRINK attacks: which nation state hackers will be the biggest threat in 2026? | IT Pro
Iranian Infy APT Resurfaces with New Malware Activity After Years of Silence
North Korea
A Good Year for North Korean Cybercriminals
CRINK attacks: which nation state hackers will be the biggest threat in 2026? | IT Pro
Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread - Security Boulevard
North Korean Beavertail malware sparks attacks across financial sector | SC Media
Tools and Controls
Cybersecurity Budgets are Going Up, Pointing to a Boom - Security Boulevard
The NCSC’s Warning To UK Firms: How To Boost Incident Response | SC Media UK
Invest in cybersecurity before it's too late - Verdict
Threat Actors Advertised NtKiller Malware on Dark Web Claiming Terminate Antivirus and EDR Bypass
Hackers Using PuTTY for Both Lateral Movement and Data Exfiltration
Cloud security is stuck in slow motion - Help Net Security
UK CEOs Expect AI, Cyberattacks and Cost Cuts to Dominate 2026
Pen testers accused of 'blackmail' over Eurostar AI flaws • The Register
Formal proofs expose long standing cracks in DNSSEC - Help Net Security
New GhostLocker Tool that Uses Windows AppLocker to Neutralize and Control EDR
Greater Manchester Police sackings over homeworking 'key jamming' - BBC News
Other News
Cybersecurity teams prep for an influx of attacks over the holidays
Hackers Using PuTTY for Both Lateral Movement and Data Exfiltration
Raspberry Pi used in attempt to take over ferry | CSO Online
Wave of cyberattacks expose French failure to protect public digital systems
Faith in the internet is fading among young Brits • The Register
The U.K.’s Cybersecurity Refresh | Lawfare
US small businesses are fighting off a wave of cyber attacks | IT Pro
Japan to urge companies to spread cybersecurity costs as attacks mount - Nikkei Asia
Vulnerability Management
LLMs can assist with vulnerability scoring, but context still matters - Help Net Security
Vulnerabilities
Operation PCPcat Hacked 59,000+ Next.js/React Servers Within 48 Hours
Cisco VPNs, Email Services Hit in Separate Threat Campaigns
Formal proofs expose long standing cracks in DNSSEC - Help Net Security
Android Attacks—Google Confirms No Fix For 30% Of All Phones
Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability
China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager
High-severity MongoDB flaw CVE-2025-14847 could lead to server takeover
Hackers Exploiting Three-Year-Old FortiGate Vulnerability to Bypass 2FA on Firewalls
Over 25,000 FortiCloud SSO devices exposed to remote attacks
Roundcube Vulnerabilities Allow Attackers to Execute Malicious Scripts
Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
Microsoft fixes Message Queuing issue in new update • The Register
Net-SNMP Vulnerability Enables Buffer Overflow and the Daemon to Crash
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 19 December 2025
Black Arrow Cyber Threat Intelligence Briefing 19 December 2025:
-Streisand Effect: Businesses That Pay Ransomware Gangs Are More Likely to Hit the Headlines
-Future of Security Holds Bigger Budgets, New Threats
-The ‘World Is Not Ready’ for AI Cyber Security Risks, Booz Allen CEO Warns
-Phishing Messages and Social Scams Flood Users Ahead of Christmas
-2025’s Top Phishing Trends and What They Mean for Your Security Strategy
-The Agentic Shift: How Autonomous AI Is Reshaping the Global Threat Landscape
-From Open Source to OpenAI: The Evolution of Third-Party Risk
-Shadow Spreadsheets: The Security Gap Your Tools Can’t See
-Financial Times Investigation Raises Questions Over King Gaming Saga
-North Korea Stole a Record $2B in Crypto This Year
-New MI6 Chief Warns of Acute Russian Threat, Urges Tech-Driven Intelligence
-The Things Young Kids Are Using AI for Are Absolutely Horrifying
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week we start with interesting research findings on organisations that pay ransoms, and we look at how organisations are planning to increase their spend on security. We also look at developments by attackers to look out for over the next year, including of course phishing and AI, as well as organisational practices highlighted in the articles that are closely linked to risk exposure.
Addressing these requires a sound understanding of how risks are evolving and the pragmatic and proportionate ways that business leaders can address them. The key is knowing the questions to ask of your control providers, including your IT, with support from impartial specialists.
As we head into the festive season, we thank you for reading our weekly summaries. We wish you a merry and peaceful holiday.
Top Cyber Stories of the Last Week
Streisand Effect: Businesses That Pay Ransomware Gangs Are More Likely to Hit the Headlines
Analysis of LockBit negotiation data suggests organisations that pay ransomware demands are more likely to attract press coverage than those that refuse. Researcher Max Smeets compared reporting on 100 payers with 100 non-payers and found paying did not reduce publicity. The data also shows victims making negotiating errors, including admitting they lacked backups or sharing insurance documents. After Operation Chronos where the US National Crime Agency seized LockBit’s infrastructure, LockBit’s reputation and payments reportedly fell sharply.
Future of Security Holds Bigger Budgets, New Threats
A Marsh survey of 2,200 cyber security leaders found two‑thirds plan to increase cyber-risk prevention investment in 2026, and at least one in four intend to raise spending by more than 25%. 70% experienced at least one third‑party security incident in the past year. Separately, US senators raised concerns about AI‑driven attacks, and analysts warned humanoid robots are currently easy to hack.
The ‘World Is Not Ready’ for AI Cyber Security Risks, Booz Allen CEO Warns
Booz Allen Hamilton CEO Horacio Rozanski warned that advanced artificial intelligence could amplify cyber threats, including network compromise, data theft and ransomware, and argued that trust in models is critical for adoption. He framed US - China competition as a race across technology, adoption and national security use. Rozanski also highlighted the risk of disruption in space, using an example of bank ATMs that rely on GPS information, and pointed to Chinese plans for space-based computing.
Phishing Messages and Social Scams Flood Users Ahead of Christmas
Check Point reported a surge of festive scams, claiming it detected 33,500 unique Christmas-themed phishing emails and over 10,000 seasonal social media ads in the prior 14 days. It said artificial intelligence is improving localisation and brand mimicry, enabling fake e-commerce sites with chatbots and checkout pages, plus deepfake and scripted voice phishing. Check Point also claimed a 100% increase in fake delivery scams in November/December compared with the same period last year.
Source: https://www.infosecurity-magazine.com/news/phishing-messages-social-scams/
2025’s Top Phishing Trends and What They Mean for Your Security Strategy
The article highlights how phishing in 2025 is evolving around authentication and multi-channel lures. It describes tactics designed to defeat or abuse multi-factor authentication, including repeated prompts and real-time interception during sign-in. It also notes attackers moving beyond email into messaging and collaboration tools, while using familiar hooks such as invoices, account warnings and delivery notifications. The article describes approaches such as layered controls, realistic user guidance and monitoring across channels.
The Agentic Shift: How Autonomous AI Is Reshaping the Global Threat Landscape
Control Risks describes an agentic shift where autonomous AI agents can plan, act and adapt with limited human input, changing both defence and offence. It notes automation can improve monitoring and response, but attackers can use agents to accelerate reconnaissance, exploitation and social engineering. Risks include where objectives are delegated to systems that behave unpredictably, and outlines governance, testing and control considerations.
From Open Source to OpenAI: The Evolution of Third-Party Risk
Third‑party risk has expanded from suppliers and open-source dependencies to include cloud services and generative AI. AI features can introduce new external dependencies and data flows, complicating vendor oversight and risk assessment. The article discusses improving visibility into components, strengthening contractual requirements, and continuously monitoring suppliers, arguing that third-party governance should be treated as a business risk discipline, not just a technical exercise.
Source: https://www.securityweek.com/from-open-source-to-openai-the-evolution-of-third-party-risk/
Shadow Spreadsheets: The Security Gap Your Tools Can’t See
“Shadow spreadsheets” are unmanaged files that end up holding operational or sensitive information outside approved systems. Employees use spreadsheets for tracking projects, budgets, access lists and customer data, bypassing access controls, logging and retention policies. Because files are often shared, copied and stored in multiple places, they can expose credentials, personal data and business logic. The article discusses discovery, ownership and governance to bring these files under control.
Financial Times Investigation Raises Questions Over King Gaming Saga
A Financial Times investigation into cyber crime and fraud has prompted scrutiny of due diligence by local authorities in their dealings with a firm called King Gaming. It focuses on how the government of the Isle of Man granted planning permission for a substantial headquarters project by King Gaming; later police executed raids linked to the operation and arrests were made. Court records from China show convictions for investment fraud by individuals connected to a related Isle of Man entity.
North Korea Stole a Record $2B in Crypto This Year
North Korea-linked actors are estimated to have stolen just over $2 billion in cryptocurrency in 2025, a 51% year‑on‑year increase, and about $3.4 billion was stolen globally. DPRK attacks accounted for a record 76% of service compromises, with the February Bybit incident contributing about $1.5 billion. The piece also reports increased targeting of personal wallets (44% of value) and a shift towards recruiter-style social engineering.
Source: https://www.theregister.com/2025/12/18/north_korea_stole_2b_crypto_2025/
New MI6 Chief Warns of Acute Russian Threat, Urges Tech-Driven Intelligence
In her first public speech as MI6 chief, Blaise Metreweli warned of a more acute Russian threat and described a security environment that sits between peace and war. She pointed to hybrid tactics, including cyberattacks on infrastructure and drones appearing over airports and airbases. The article also highlights her emphasis on technology and tradecraft, saying MI6 officers must be as comfortable with code as with human sources and fluent in Python.
Source: https://www.easterneye.biz/new-mi6-chief-warns-russian-threat/
The Things Young Kids Are Using AI for Are Absolutely Horrifying
An Aura report analysing anonymised activity from about 3,000 children aged five to 17 found 42% used AI chatbots specifically for companionship across nearly 90 services. Among those using chatbots for companionship, 37% engaged in conversations depicting violence, including coercion and non-consensual acts. The report says violent conversations peaked among 11-year-olds, with 44% of interactions turning violent, and that sexual or romantic roleplay peaked among 13-year-olds at 63%.
Source: https://futurism.com/future-society/young-kids-using-ai
Governance, Risk and Compliance
How to justify your security investments | CSO Online
News brief: Future of security holds bigger budgets, new threats | TechTarget
The CISO-COO Partnership: Protecting Operational Excellence
The internet in 2025: Bigger, more fragile than ever - and 'fundamentally rewired' by AI | ZDNET
The Budget Effect of a Security Incident - Infosecurity Magazine
Cyber resilience in the UK: learning to take the punches | IT Pro
Trend Micro's 2025 Defenders Survey Report | Trend Micro (US)
Increased workloads, strategic influence and technical focus - CISO predictions for 2026 - BetaNews
Threats
Ransomware, Extortion and Destructive Attacks
RansomHouse RaaS Service Upgraded with Double Extortion Strategy that Steals and Encrypt Data
Clop ransomware targets Gladinet CentreStack in data theft attacks
Researchers see global surge in attacks by new ransomware group “Gentlemen” | Cybernews
The Hidden Risk in Virtualization: Why Hypervisors are a Ransomware Magnet
How CISOs Can Beat the Ransomware Blame Game - Security Boulevard
VolkLocker Ransomware Exposed by Hard-Coded Master Key Allowing Free Decryption
Ransomware Victims
JLR cyberattack pushes TCS to standardize security for top clients | Company Business News
Jaguar Land Rover workers’ payroll data stolen in cyber attack
PornHub extorted after hackers steal Premium member activity data
Askul confirms theft of 740k customer records in ransomware attack
Asahi to Launch Cybersecurity Overhaul After Crippling Cyber-Attack - Infosecurity Magazine
Under Armour Sued After Ransomware Group Reports Data Breach (1)
Phishing & Email Based Attacks
New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale
2025’s Top Phishing Trends and What They Mean for Your Security Strategy
OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365 - Infosecurity Magazine
Where does the data stolen in a phishing attack go? | Kaspersky official blog
Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files - Infosecurity Magazine
Inside a purchase order PDF phishing campaign | Malwarebytes
Clipping Scripted Sparrow's wings: Tracking a global phishing ring - Help Net Security
Google Sues Chinese ‘Darcula’ Group Over Alleged Phishing Scheme
New ForumTroll Phishing Attacks Target Russian Scholars Using Fake eLibrary Emails
Other Social Engineering
Hackers Are Stealing Microsoft Account Passwords With This Trick
Shut Down And Restart—New Microsoft Attack Beats Passwords, 2FA And Passkeys
ClickFix attacks that bypass cyber controls on the rise | Computer Weekly
New ClickFix 'Word Online' Message Tricks Users into Installing DarkGate Malware
The WhatsApp takeover scam that doesn’t need your password
Deepfakes Expose New Risks in Identity and Digital Trust
Amazon blocked 1,800 suspected DPRK job applicants • The Register
Inside a purchase order PDF phishing campaign | Malwarebytes
Fraud, Scams and Financial Crime
Financial Times investigation raises questions over King Gaming saga | Isle of Man Today
Money Mules Require Banks to Switch from Defense to Offense
European authorities dismantle call center fraud ring in Ukraine
What Is 'NGate'? The Android Phone ATM Scam You Need To Know About
Darkweb Powers Decentralized Financial Crimes
Hacker Busts Startup Running Huge Web of AI-Generated "Influencers" on Instagram
Nomad settles with the FTC over $186M cyberattack • The Register
HMRC Warns of Over 135,000 Scam Reports - Infosecurity Magazine
Myanmar calls on countries to take back citizens held in crackdown on scam centers - ABC News
Singapore Entrepreneur Loses Entire Crypto Portfolio After Downloading Fake Game - Decrypt
Artificial Intelligence
New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale
Cybersecurity Crossed the AI Rubicon: Why 2025 Marked a Point of No Return - Security Boulevard
Deepfakes Expose New Risks in Identity and Digital Trust
The internet in 2025: Bigger, more fragile than ever - and 'fundamentally rewired' by AI | ZDNET
AI-era cybersecurity is 'so dangerous,' CrowdStrike pres. explains
AI breaks the old security playbook - Help Net Security
The agentic shift: how autonomous AI is reshaping the global threat landscape
Chrome, Edge privacy extensions quietly snarf AI chats • The Register
Hacker Busts Startup Running Huge Web of AI-Generated "Influencers" on Instagram
Militant Groups Are Experimenting With AI, and the Risks Are Expected to Grow - SecurityWeek
The Things Young Kids Are Using AI for Are Absolutely Horrifying
NIST releases draft AI cybersecurity framework profile to guide secure AI adoption - SiliconANGLE
What Cyber Defenders Really Think About AI Risk | Trend Micro (US)
I Work at Google in AI Security: Things I Would Never Tell Chatbots - Business Insider
AI is causing all kinds of problems in the legal sector | CyberScoop
AML/CFT/Money Laundering/Terrorist Financing/Sanctions
Europe Targets Kremlin Disinformation, Cyber Networks in New Sanctions Push
EU Sanctions Target Russia’s ‘Shadow Fleet’ Backers and Disinformation Network - The Moscow Times
2FA/MFA
New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale
Your Accounts Can Still Get Hacked, Even Using Multi-Factor Authentication
Malware
Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery - SecurityWeek
New ClickFix 'Word Online' Message Tricks Users into Installing DarkGate Malware
New SantaStealer malware steals data from browsers, crypto wallets
What is driving the rise of infostealer malware? | Computer Weekly
A Browser Extension Risk Guide After the ShadyPanda Campaign
17 Firefox extensions hide malware in icons | Cybernews
China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
Stop clicking “allow” on these pop-ups — they’re more dangerous than malware
Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files - Infosecurity Magazine
Fake OSINT and GPT Utility GitHub Repos Spread PyStoreRAT Malware Payloads
Elastic detects stealthy NANOREMOTE malware using Google Drive as C2
ZnDoor Malware Exploiting React2Shell Vulnerability to Compromise Network Devices
Fake ‘One Battle After Another’ torrent hides malware in subtitles
New BeaverTail Malware Variant Linked to Lazarus Group - Infosecurity Magazine
Fake Zoom malware scam tied to North Korean hackers targets crypto users - CoinJournal
Man jailed for teaching criminals how to use malware
Bots/Botnets
Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks
Mobile
What Is 'NGate'? The Android Phone ATM Scam You Need To Know About
The WhatsApp takeover scam that doesn’t need your password
Android mobile adware surges in second half of 2025 | Malwarebytes
'Cellik' Android RAT Leverages Google Play Store
Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App
The ghosts of WhatsApp: How GhostPairing hijacks accounts | Malwarebytes
WhatsApp users unknowingly link hackers’ devices | Cybernews
Europe's DMA raises new security worries for mobile ecosystems - Help Net Security
‘Completely Deactivate Wi-Fi’—Cyber Agency Warns iPhone And Android Users
Microsoft to block Exchange Online access for outdated mobile devices
Denial of Service/DoS/DDoS
Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks
Internet of Things – IoT
Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks
Is your smart home an easy target? 6 ways experts lock theirs down | ZDNET
Your car’s web browser may be on the road to cyber ruin • The Register
Data Breaches/Leaks
Coupang data breach traced to ex-employee who retained system access
ICO Issues Post Office Public Reprimand Instead of Fine Over Data Breach - IT Security Guru
Featured Chrome Browser Extension Caught Intercepting Millions of Users' AI Chats
Data breach at credit check giant 700Credit affects at least 5.6 million | TechCrunch
PornHub Premium hacked. This is the info they reportedly stole. | Mashable
Analytics provider: We didn't expose stolen smut data • The Register
Data may have been taken in Ombudsman office cyber attack
French Interior Ministry confirms cyberattack on email servers
France arrests suspect tied to cyberattack on Interior Ministry
UK Information Commissioner Investigates Film & TV Worker Data Breach
Personal data breach affects thousands across Channel Islands - BBC News
GDPR failures in Home Office eVisa rollout in spotlight • The Register
SoundCloud confirms breach after member data stolen, VPN access disrupted
NHS tech supplier probes cyberattack on internal systems • The Register
University of Sydney suffers data breach exposing student and staff info
Organised Crime & Criminal Actors
Financial Times investigation raises questions over King Gaming saga | Isle of Man Today
Scammers, spies and triads: inside cyber-crime’s $15tn global empire | FT Film
North Korea stole a record $2B in crypto this year • The Register
Hackers Are Stealing Microsoft Account Passwords With This Trick
Money Mules Require Banks to Switch from Defense to Offense
European authorities dismantle call center fraud ring in Ukraine
Darkweb Powers Decentralized Financial Crimes
Nomad settles with the FTC over $186M cyberattack • The Register
Third Defendant Pleads Guilty in Fantasy Sports Betting Hack Case - Infosecurity Magazine
Myanmar calls on countries to take back citizens held in crackdown on scam centers - ABC News
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
North Korea stole a record $2B in crypto this year • The Register
New SantaStealer malware steals data from browsers, crypto wallets
Nomad settles with the FTC over $186M cyberattack • The Register
Fake Zoom malware scam tied to North Korean hackers targets crypto users - CoinJournal
Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign
Singapore Entrepreneur Loses Entire Crypto Portfolio After Downloading Fake Game - Decrypt
Insider Risk and Insider Threats
Coupang data breach traced to ex-employee who retained system access
Amazon blocked 1,800 suspected DPRK job applicants • The Register
Insurance
What is a Cyber Insurance Managing General Agent?
Supply Chain and Third Parties
JLR cyberattack pushes TCS to standardize security for top clients | Company Business News
From Open Source to OpenAI: The Evolution of Third-Party Risk - SecurityWeek
PornHub Premium hacked. This is the info they reportedly stole. | Mashable
Analytics provider: We didn't expose stolen smut data • The Register
NHS tech supplier probes cyberattack on internal systems • The Register
Software Supply Chain
From Open Source to OpenAI: The Evolution of Third-Party Risk - SecurityWeek
Cloud/SaaS
Elastic detects stealthy NANOREMOTE malware using Google Drive as C2
OAuth Device Code Phishing Campaigns Surge Targets Microsoft 365 - Infosecurity Magazine
US sues ex-Accenture manager over Army cloud security claims • The Register
Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign
NATO's battle for cloud sovereignty: Speed is existential • The Register
Identity and Access Management
Identity risk is changing faster than most security teams expect - Help Net Security
Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign
Encryption
Linux and Open Source
From Open Source to OpenAI: The Evolution of Third-Party Risk - SecurityWeek
Passwords, Credential Stuffing & Brute Force Attacks
New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale
FBI Confirms 630 Million Stolen Passwords — How To Check Yours Now
Social Media
Deepfakes Expose New Risks in Identity and Digital Trust
Hacker Busts Startup Running Huge Web of AI-Generated "Influencers" on Instagram
Privacy risks sit inside the ads that fill your social media feed - Help Net Security
Meta adopts new age-check system to meet global child safety laws
Regulations, Fines and Legislation
Financial Times investigation raises questions over King Gaming saga | Isle of Man Today
Scammers, spies and triads: inside cyber-crime’s $15tn global empire | FT Film
ICO Issues Post Office Public Reprimand Instead of Fine Over Data Breach - IT Security Guru
UK Lords propose ban on VPNs for children | TechRadar
Making cybercrime illegal won't stop it; making cybersec research legal may | CSO Online
Whistleblowers raise ‘extreme’ concern about security of government’s Digital ID | ITV News
Nomad settles with the FTC over $186M cyberattack • The Register
Europe's DMA raises new security worries for mobile ecosystems - Help Net Security
UK surveillance law still full of holes, watchdog warns • The Register
Are Trade Concerns Trumping Cybersecurity?
Trump Administration Turning to Private Firms in Cyber Offensive
Legal protection for ethical hacking is only the first step • The Register
Models, Frameworks and Standards
ICO Issues Post Office Public Reprimand Instead of Fine Over Data Breach - IT Security Guru
UK Lords propose ban on VPNs for children | TechRadar
GDPR failures in Home Office eVisa rollout in spotlight • The Register
NIST releases draft AI cybersecurity framework profile to guide secure AI adoption - SiliconANGLE
Data Protection
ICO Issues Post Office Public Reprimand Instead of Fine Over Data Breach - IT Security Guru
GDPR failures in Home Office eVisa rollout in spotlight • The Register
Careers, Roles, Skills, Working in Cyber and Information Security
EU can’t attract and retain cyber talent: why? | Cybernews
What lies in store for cyber security skills in 2026? | Computer Weekly
Increased workloads, strategic influence and technical focus - CISO predictions for 2026 - BetaNews
The Burnout Nobody Talks About: When “Always-On” Leadership Becomes a Liability - Security Boulevard
Leading Through Ambiguity: Decision-Making in Cybersecurity Leadership - Security Boulevard
Law Enforcement Action and Take Downs
European police busts Ukraine scam call centers - Help Net Security
France arrests suspect tied to cyberattack on Interior Ministry
Third Defendant Pleads Guilty in Fantasy Sports Betting Hack Case - Infosecurity Magazine
Myanmar calls on countries to take back citizens held in crackdown on scam centers - ABC News
Man jailed for teaching criminals how to use malware
France arrests Latvian for installing malware on Italian ferry
Misinformation, Disinformation and Propaganda
EU Sanctions Target Russia’s ‘Shadow Fleet’ Backers and Disinformation Network - The Moscow Times
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
MI6 chief: 'We are operating in space between peace and war' - BBC News
MI6 chief warns of Russian hybrid threats, urges tech focus | EasternEye
China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
The agentic shift: how autonomous AI is reshaping the global threat landscape
Three ways teams can tackle Iran's tangled web of state-sponsored espionage | SC Media
Israel Issues Chilling Cyber Warfare Warning After Iran Attacks
Russia suspected of hacking European ferry with ‘remote control’
Nation State Actors
A ‘whole society’ response to threats to national security
China
Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery - SecurityWeek
A Browser Extension Risk Guide After the ShadyPanda Campaign
The $0 Transaction That Signaled a Nation-State Cyberattack
US has failed to stop massive Chinese cyber campaign, warns senator
React2Shell vuln exploited by China, Iran, Google warns • The Register
China's Ink Dragon hides out in European government networks • The Register
China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear - SecurityWeek
China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
Financial Times investigation raises questions over King Gaming saga | Isle of Man Today
Scammers, spies and triads: inside cyber-crime’s $15tn global empire | FT Film
Google Sues Chinese ‘Darcula’ Group Over Alleged Phishing Scheme
Russia
MI6 chief: 'We are operating in space between peace and war' - BBC News
MI6 chief warns of Russian hybrid threats, urges tech focus | EasternEye
France and Germany Grappling With Nation-State Hacks
Germany accuses Russia of 2024 cyber attack and election disinformation campaign - BBC News
EU Sanctions Target Russia’s ‘Shadow Fleet’ Backers and Disinformation Network - The Moscow Times
Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files - Infosecurity Magazine
Amazon security boss blames Russia's GRU for energy hacks • The Register
Russia suspected of hacking European ferry with ‘remote control’
Amazon disrupts Russian GRU hackers attacking edge network devices
German Parliament Hit By Cyber-Attack During Zelensky Visit
Flaw in Hacktivist Ransomware Lets Victims Decrypt Own Files
Iran
Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery - SecurityWeek
React2Shell vuln exploited by China, Iran, Google warns • The Register
Dormant Iran APT is Still Alive, Spying on Dissidents
Three ways teams can tackle Iran's tangled web of state-sponsored espionage | SC Media
Israel Issues Chilling Cyber Warfare Warning After Iran Attacks
North Korea
North Korea stole a record $2B in crypto this year • The Register
Amazon blocked 1,800 suspected DPRK job applicants • The Register
Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App
Fake Zoom malware scam tied to North Korean hackers targets crypto users - CoinJournal
New BeaverTail Malware Variant Linked to Lazarus Group - Infosecurity Magazine
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Flaw in Hacktivist Ransomware Lets Victims Decrypt Own Files
Militant Groups Are Experimenting With AI, and the Risks Are Expected to Grow - SecurityWeek
Tools and Controls
The Hidden Risk in Virtualization: Why Hypervisors are a Ransomware Magnet
Amazon disrupts Russian GRU hackers attacking edge network devices
A Browser Extension Risk Guide After the ShadyPanda Campaign
From Open Source to OpenAI: The Evolution of Third-Party Risk - SecurityWeek
How to justify your security investments | CSO Online
News brief: Future of security holds bigger budgets, new threats | TechTarget
The Budget Effect of a Security Incident - Infosecurity Magazine
More than half of public vulnerabilities bypass leading WAFs - Help Net Security
5 ways to scour the dark web for your data after Google kills its free report | ZDNET
AI isn't one system, and your threat model shouldn’t be either - Help Net Security
Reports Published in the Last Week
Trend Micro's 2025 Defenders Survey Report | Trend Micro (US)
Other News
How the Hacking World Has Changed: 'All Tech is Political'
CISO Communities – Cybersecurity’s Secret Weapon - SecurityWeek
Shadow spreadsheets: The security gap your tools can’t see
Cybersecurity - indispensable in the defense industry
Most schools underprepared for cybersecurity threats - BetaNews
No more orange juice? Why one ship reveals America's maritime cybersecurity crisis | CSO Online
The soft underbelly of space isn't in orbit, it's on the ground - Help Net Security
Online Attacks Against Women Human Rights Workers Double In Five Years
Vulnerability Management
More than half of public vulnerabilities bypass leading WAFs - Help Net Security
41 Microsoft Zero-Day Warnings — Millions Of Users Face Update Choice
Vulnerabilities
Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery - SecurityWeek
React2Shell vuln exploited by China, Iran, Google warns • The Register
React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors
React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation
Half of exposed React servers remain unpatched amid attacks • The Register
Another bad week for SonicWall as SMA 1000 0-day exploited • The Register
China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear - SecurityWeek
Google and Apple roll out emergency security updates after zero-day attacks | TechCrunch
Emergency fixes deployed by Google and Apple after targeted attacks
Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild
Chrome Security Update - Patch for Critical Vulnerabilities that Enables Remote Code Execution
Hackers are exploiting critical Fortinet flaws days after patch release
Notepad++ fixed updater bugs that allowed malicious update hijacking
Microsoft: December security updates cause Message Queuing failures
Windows Admin Center Vulnerability (CVE-2025-64669) Let Attackers Escalate Privileges
Windows Remote Access Connection Manager Vulnerability Enables Arbitrary Code Execution
New UEFI Flaw Enables Early-Boot DMA Attacks on ASRock, ASUS, GIGABYTE, MSI Motherboards
Microsoft RasMan 0-day gets an unofficial patch and exploit • The Register
Recent GeoServer Vulnerability Exploited in Attacks - SecurityWeek
Hewlett Packard Enterprise (HPE) fixed maximum severity OneView flaw
CISA Adds Actively Exploited Sierra Wireless Router Flaw Enabling RCE Attacks
JumpCloud Windows Agent Flaw Enables Local Privilege Escalation - Infosecurity Magazine
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 12 December 2025
Black Arrow Cyber Threat Intelligence Briefing 12 December 2025:
-Human-Centric Cyber Risks Surge as AI Enters the Workforce, Report Finds
-Trend Micro Issues Warning Over Rise of 'Vibe Crime' as Cyber Criminals Turn to Agentic AI to Automate Attacks
-What the Rise in Cyber Insurance Claims Reveals About the Vulnerability of UK Businesses
-Nearly Two-Thirds of Organisations to Increase Cyber Security Investments in 2026: Marsh
-When It Comes to Security Resilience, Cheaper Isn’t Always Better
-Cyber Threats Are Evolving Fast - Is Your Leadership Keeping Up?
-A Tale of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability
-Why Small Businesses Can’t Afford to Overlook Cyber Security This Peak Season
-New DroidLock Malware Locks Android Devices and Demands a Ransom
-Push Security Uncovers “ConsentFix”: A New Class of Browser-Native Phishing Attack
-Report Surfaces Multiple Novel Social Engineering Tactics and Techniques
-EU Leaders to Push Defence Readiness Amid Russia ‘Hybrid Attack’ Warnings
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
With our sights on the New Year, our review this week looks at cyber security in 2026 and the risks that we all need to manage. Without doubt, AI is a major factor in that, both when used by organisations without a defined security policy as well as when used maliciously by attackers as described below. There are also some interesting insights from an analysis of cyber insurance claims in our review this week, and we include news of new tactics by attackers through mobile devices and social engineering.
We are clear that cyber security requires business leaders to understand current risks, and to implement aligned controls across people, operations and technology. The evolution of AI and other risks in 2026 further reinforces the need for this business-wide approach, supported by a CISO that can translate between technology and business management. Proportionality is always a key consideration, balancing cost and effectiveness. Contact us to see how to achieve this through a pragmatic and commercially aligned strategy.
Top Cyber Stories of the Last Week
Human-Centric Cyber Risks Surge as AI Enters the Workforce, Report Finds
Research highlights a sharp rise in incidents linked to human behaviour as AI becomes embedded in daily work. Organisations report significant growth in email-driven attacks, social engineering, unsafe behaviour, and mistakes. AI-related incidents and deepfake-enabled fraud are increasing, while shadow AI usage is expanding as employees turn to unsanctioned tools, weakening visibility and control over data and decision-making.
Trend Micro Issues Warning Over Rise of 'Vibe Crime' as Cyber Criminals Turn to Agentic AI to Automate Attacks
Trend Micro warns that so-called vibe crime will accelerate cyber crime by enabling autonomous, end-to-end attack chains powered by agentic AI. Rather than sudden spikes, organisations should expect persistent background activity that scales without human oversight. This evolution reframes cybercrime-as-a-service into a model where AI performs continuous reconnaissance, phishing, fraud, and exploitation.
Source: https://www.itpro.com/security/cyber-crime/trend-micro-vibe-crime-agentic-ai-cyber-crime
What the Rise in Cyber Insurance Claims Reveals About the Vulnerability of UK Businesses
UK cyber insurance claims have surged, reflecting both rising threat activity and weaknesses created by outsourcing, poor oversight, and complex supply chains. Cost-driven decisions can reduce visibility and weaken access controls, increasing exposure. Higher premiums alone are unlikely to fix the problem, with current payouts seen as an early warning of deeper systemic risk without stronger controls and better risk maturity.
Source: https://www.techmonitor.ai/comment-2/cyber-insurance-uk-vulnerabilities?cf-view
Nearly Two-Thirds of Organisations to Increase Cyber Security Investments in 2026: Marsh
Marsh reports that most organisations plan to increase cyber security spending, with many expecting significant budget rises. Third-party risk is a major driver, as a large proportion experienced at least one material supplier-related cyber incident in the past year. UK organisations show particularly strong intent to increase investment to address exposure and resilience gaps.
When It Comes to Security Resilience, Cheaper Isn’t Always Better
Cost-focused procurement can undermine cyber resilience by increasing dependency on fragile suppliers and underinvested controls. Savings achieved through cheaper vendors can be quickly erased by incidents such as ransomware, service disruption, or third-party data compromise. The article argues for procurement incentives that prioritise resilience and continuity, treating cyber security as a core business survival issue rather than a compliance cost.
Cyber Threats Are Evolving Fast - Is Your Leadership Keeping Up?
Effective cyber security depends on leadership, governance, and organisational culture, not just technology. Incidents damage trust, reputation, and revenue, while early executive response often determines the scale of impact. The article stresses the importance of senior ownership, clear communication, and disciplined programme management to translate cyber strategy into consistent, operational outcomes.
A Tale of Two CISOs: Why An Engineering-Focused CISO Can Be a Liability
An engineering-led approach to cyber security can create blind spots by assuming strong preventative controls are sufficient. Risk often shifts into overlooked areas such as permissions, pipelines, and operational processes. A more effective model assumes failure, focuses on limiting blast radius, rehearses response, and aligns people, process, and technology under strong governance.
Source: https://www.darkreading.com/cyber-risk/why-an-engineering-focused-ciso-can-be-a-liability
Why Small Businesses Can’t Afford to Overlook Cyber Security This Peak Season
Peak retail periods attract heightened attacker activity as transaction volumes rise. Phishing, ransomware, and malware campaigns intensify, with seasonal lures proving highly effective. For small businesses, cyber security failures can disrupt sales, expose customer data, and trigger recovery costs, making basic protections essential to protecting revenue during critical trading periods.
New DroidLock Malware Locks Android Devices and Demands a Ransom
DroidLock is a newly identified Android threat that locks devices and demands payment while harvesting sensitive data including messages, contacts, call logs, and recordings. The malware can be remotely controlled and can wipe data or steal lock patterns. Campaigns target Spanish-speaking users and spread through malicious sites offering fake apps that request extensive permissions.
Push Security Uncovers “ConsentFix”: A New Class of Browser-Native Phishing Attack
ConsentFix blends social engineering with open authorisation (OAuth) consent abuse to enable account takeover without requiring traditional login credentials. By operating entirely within the browser and targeting trusted first-party applications, the technique can bypass MFA and endpoint controls. Distribution through search results further reduces reliance on email-based phishing, complicating detection.
Report Surfaces Multiple Novel Social Engineering Tactics and Techniques
Threat researchers report attackers using increasingly creative social engineering techniques to evade controls and deliver malware. Campaigns include legal-themed emails, fake government sites, malicious SVG files, and counterfeit software updates. Information-stealing malware dominates observed threats, while a notable proportion of malicious emails bypass gateway scanning.
EU Leaders to Push Defence Readiness Amid Russia ‘Hybrid Attack’ Warnings
EU leaders will use the December European Council summit to accelerate defence cooperation, boost weapons production for Ukraine, and strengthen protection against cyber and drone attacks. Draft conclusions warn of an intensified hybrid campaign by Russia and Belarus and call for faster resilience measures, shared military capabilities, and new funding. Leaders will also debate long-term support for Ukraine through at least 2027, including use of frozen Russian assets.
Governance, Risk and Compliance
When it comes to security resilience, cheaper isn’t always better | CSO Online
Why small businesses can’t afford to overlook cybersecurity this peak season - Raconteur
Why An Engineering-Focused CISO Can Be a Liability
Are we mistaking regulation for resilience? | Computer Weekly
“Cyber Tax” Warning as Two-Fifths of SMBs Raise Prices After Breach - Infosecurity Magazine
Resilience is the new currency | Professional Security Magazine
Cyber Threats Are Evolving Fast — Are You Keeping Up?
Need for 'attacking mindset' as major cyber hacks up 50 per cent | In Cumbria
Cybersecurity Threats and AI Disruptions Top Concerns for IT Leaders in 2026, Veeam Survey Finds
CISOs are spending big and still losing ground - Help Net Security
Global Cyber Alliance Identifies Five Cybersecurity Forces That Defined 2025 - And Will Shape 2026
Cybersecurity Leaders Put Data Protection and Response at the Top of the 2026 Agenda.
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Payments Surpassed $4.5 Billion: US Treasury - SecurityWeek
Researchers spot 700 percent increase in hypervisor attacks • The Register
Cyber insurance claims in 2024 tripled. UK firms are vulnerable
New DroidLock malware locks Android devices and demands a ransom
Ransomware keeps widening its reach - Help Net Security
Banks paid $370M in ransoms to cybercriminals in 2024 | American Banker
Ransomware IAB abuses EDR for stealthy malware execution
Packer-as-a-Service Shanya Hides Ransomware, Kills EDR
DeadLock Ransomware Uses BYOVD to Evade Security Measures - Infosecurity Magazine
Ransomware Targeting Hyper-V and VMware ESXi Surges as Akira Group Exploits System Vulnerabilities
Akira ransomware: FBI tallies 250 million in payouts – DataBreaches.Net
Ransomware Victim Warning: The Streisand Effect May Apply
Russian hackers debut simple ransomware service • The Register
Ransomware gangs turn to Shanya EXE packer to hide EDR killers
Contractors with hacking records accused of wiping 96 govt databases
FBI: Crooks manipulate online photos to fuel virtual kidnapping ransoms
Industrial ransomware attacks rise sharply in Q3 2025
UK ransomware payment ban could ‘significantly shift’ cyber market :: Insurance Day
Ransomware Victims
Banks paid $370M in ransoms to cybercriminals in 2024 | American Banker
NHS taking legal action after patient and staff data stolen in cyber attack | The Independent
Barts Health NHS discloses data breach after Oracle zero-day hack
Industrial ransomware attacks rise sharply in Q3 2025
Cyber attack chaos ahead of Christmas | Westminster Extra
UK Hospital Asks Court to Stymie Ransomware Data Leak
HSE offers €750 to victims of 2021 cyberattack which affected 90,000 people | Irish Independent
Phishing & Email Based Attacks
How phishers hide banking scams behind free Cloudflare Pages | Malwarebytes
New Spiderman phishing service targets dozens of European banks
Novel clickjacking attack relies on CSS and SVG • The Register
AI Is Driving a Shift in Targeted Email Attacks
Other Social Engineering
Push Security Uncovers “ConsentFix”: A New Class of Browser-Native Phishing Attack
Novel clickjacking attack relies on CSS and SVG • The Register
Global Scams, From Southeast Asia's Pig Butchering to Russia's 'Black Widows'
New Vishing Attack Leverages Microsoft Teams Call and QuickAssist to Deploy .NET Malware
ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery
ClickFix Social Engineering Sparks Rise of CastleLoader Attacks - Infosecurity Magazine
Report Surfaces Multiple Novel Social Engineering Tactics and Techniques - Security Boulevard
Imposter for hire: How fake people can gain very real access | Microsoft Security Blog
Hackers posed as law enforcement to gain Apple Account data
FBI: Crooks manipulate online photos to fuel virtual kidnapping ransoms
Crims using social media images in virtual kidnapping scams • The Register
Fraud, Scams and Financial Crime
Global Scams, From Southeast Asia's Pig Butchering to Russia's 'Black Widows'
How phishers hide banking scams behind free Cloudflare Pages | Malwarebytes
Key barrier to online fraud can be bypassed for pennies, say researchers - CNA
California man admits role in $263 million cryptocurrency theft that funded lavish lifestyle
Myanmar's army says it wants to eradicate scam compounds. Is it really doing that? - BBC News
Scam-Busting FCA Firm Checker Tool Given Cautious Welcome - Infosecurity Magazine
‘Report fraud’ service replaces Action Fraud as UK’s official reporting portal
Artificial Intelligence
Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks
Block all AI browsers for the foreseeable future: Gartner • The Register
UK cyber agency warns LLMs will always be vulnerable to prompt injection | CyberScoop
New Prompt Injection Attack via Malicious MCP Servers Let Attackers Drain Resources
OpenAI warns new models pose 'high' cybersecurity risk - CNA
Human-Centric Cyber Risks Surge as AI Enters the Workforce, Report Finds - IT Security Guru
Exclusive | AI Hackers Are Coming Dangerously Close to Beating Humans - WSJ
ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery
Cybersecurity Threats and AI Disruptions Top Concerns for IT Leaders in 2026, Veeam Survey Finds
NVIDIA research shows how agentic AI fails under attack - Help Net Security
UK NCSC Raises Alarms Over Prompt Injection Attacks - Infosecurity Magazine
LLMs are everywhere in your stack and every layer brings new risk - Help Net Security
Ignoring AI in the threat chain could be a costly mistake, experts warn | CSO Online
Cyber experts warn AI will accelerate attacks and overwhelm defenders in 2026 - BetaNews
AI is accelerating cyberattacks. Is your network prepared?
Latest macOS malware uses trusted search & AI to dupe users
Copilot's No Code AI Agents Liable to Leak Company Data
AI Is Driving a Shift in Targeted Email Attacks
The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature | Kaspersky official blog
It's time to revamp IT security to deal with AI
OpenAI user data was breached, but changing your password won't help - here's why | ZDNET
Tehran and Moscow sign deal on AI, cybersecurity | Iran International
Police Admit AI Surveillance Panopticon Still Has Issues With "Some Demographic Groups"
Brussels attacks Google for ‘unfairly harvesting’ web and YouTube content for AI
Privacy concerns raised as Grok AI found to be a stalker's best friend
Trump Signs Executive Order to Block State AI Regulations - SecurityWeek
AML/CFT/Money Laundering/Terrorist Financing/Sanctions
Predator Spyware Maker Intellexa Evades Sanctions - Infosecurity Magazine
Britain sanctions Russian, Chinese entities over disinfo, cyber threats - CNA
2FA/MFA
Death to one-time text codes: Passkeys are the new hotness • The Register
Android Warning—New Attack Unlocks Your Phone And Steals Your Texts
Malware
Wide Range of Malware Delivered in React2Shell Attacks - SecurityWeek
ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery
Latest macOS malware uses trusted search & AI to dupe users
New Vishing Attack Leverages Microsoft Teams Call and QuickAssist to Deploy .NET Malware
ClickFix Social Engineering Sparks Rise of CastleLoader Attacks - Infosecurity Magazine
Ransomware IAB abuses EDR for stealthy malware execution
Packer-as-a-Service Shanya Hides Ransomware, Kills EDR
DeadLock Ransomware Uses BYOVD to Evade Security Measures - Infosecurity Magazine
Information stealers are on the rise, are you at risk? | Cyber.gov.au
Four Threat Clusters Using CastleLoader as GrayBravo Expands Its Malware Service Infrastructure
Threat Actors Poisoning SEO Results to Attack Organizations With Fake Microsoft Teams Installer
Malicious Microsoft VS Code extensions steal data | Cybernews
'PyStoreRAT' malware uses fake developer tools on GitHub to infect Windows systems - SiliconANGLE
NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems
The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature | Kaspersky official blog
Threat Actors Deploying CoinMiner Malware via USB Drives Infecting Workstations
Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT
Malicious VSCode extensions on Microsoft's registry drop infostealers
Researchers Find Malicious VS Code, Go, npm, and Rust Packages Stealing Developer Data
MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign
New Mirai Botnet Variant 'Broadside' Actively Attacking Users in the Wild
Bots/Botnets
Bots, bias, and bunk: How to tell what's real on the net • The Register
Analysts Warn of Cybersecurity Risks in Humanoid Robots
'Botnets in physical form' are top humanoid robot risk • The Register
New 'Broadside' Botnet Poses Risk to Shipping Companies - SecurityWeek
New Mirai Botnet Variant 'Broadside' Actively Attacking Users in the Wild
Mobile
New DroidLock malware locks Android devices and demands a ransom
Android Malware FvncBot, SeedSnatcher, and ClayRat Gain Stronger Data Theft Features
New malware turns trusted banking apps into phone hijacking tools — how to stay safe | Tom's Guide
Android Warning—New Attack Unlocks Your Phone And Steals Your Texts
ClayRat Android Spyware Expands Capabilities - Infosecurity Magazine
Uneven regulatory demands expose gaps in mobile security - Help Net Security
Internet of Things – IoT
Porsche panic in Russia as cars mysteriously bricked • The Register
Should you be afraid of smart home hacking? 6 ways experts keep their devices protected | ZDNET
Porsche outage in Russia serves as a reminder of the risks in connected vehicle security
Data Breaches/Leaks
Copilot's No Code AI Agents Liable to Leak Company Data
OpenAI user data was breached, but changing your password won't help - here's why | ZDNET
Spain arrests teen who stole 64 million personal data records
NHS taking legal action after patient and staff data stolen in cyber attack | The Independent
US military contractor breach expose employee data | Cybernews
Over 10,000 Docker Hub images found leaking credentials, auth keys
PSNI officer 'felt fear and disbelief' after data breach - BBC News
Users report chaos as Legal Aid Agency stumbles back online • The Register
Contractors with hacking records accused of wiping 96 govt databases
Coupang CEO Resigns Following Major Data Breach Exposing 34 Million Customers - IT Security Guru
Hospice Firm, Eye Care Practice Notifying 520,000 of Hacks
Hackers claim Volkswagen dealer data is for sale | Cybernews
One of Sudan’s last flying airlines breached, say hackers | Cybernews
Organised Crime & Criminal Actors
Global Scams, From Southeast Asia's Pig Butchering to Russia's 'Black Widows'
European cops arrest 193 'violence-as-a-service' suspects • The Register
Contractors with hacking records accused of wiping 96 govt databases
Ex-teen hackers warn parents are clueless as children steal ‘millions’ – DataBreaches.Net
National cybercrime network operating for 14 years dismantled in Indonesia | TechRadar
How old is the average hacker? What does a new research report suggest? (1) – DataBreaches.Net
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
California man admits role in $263 million cryptocurrency theft that funded lavish lifestyle
Threat Actors Deploying CoinMiner Malware via USB Drives Infecting Workstations
Insider Risk and Insider Threats
Human-Centric Cyber Risks Surge as AI Enters the Workforce, Report Finds - IT Security Guru
Insurance
Cyber insurance claims in 2024 tripled. UK firms are vulnerable
UK ransomware payment ban could ‘significantly shift’ cyber market :: Insurance Day
Supply Chain and Third Parties
NHS taking legal action after patient and staff data stolen in cyber attack | The Independent
Barts Health NHS discloses data breach after Oracle zero-day hack
UK Hospital Asks Court to Stymie Ransomware Data Leak
Software Supply Chain
'PyStoreRAT' malware uses fake developer tools on GitHub to infect Windows systems - SiliconANGLE
Malware Discovered in 19 Visual Studio Code Extensions - Infosecurity Magazine
Researchers Find Malicious VS Code, Go, npm, and Rust Packages Stealing Developer Data
Cloud/SaaS
New Vishing Attack Leverages Microsoft Teams Call and QuickAssist to Deploy .NET Malware
NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems
Swiss Government Sounds The Alarm Bell Over Cloud Storage Security Risks
US charges former Accenture employee with misleading feds on cloud platform’s security - Nextgov/FCW
Microsoft investigates Copilot outage affecting users in Europe
Outages
Cloudflare Outage Caused by React2Shell Mitigations - SecurityWeek
Microsoft investigates Copilot outage affecting users in Europe
Porsche outage in Russia serves as a reminder of the risks in connected vehicle security
Encryption
CISOs Should Be Asking These Quantum Questions Today
Passwords, Credential Stuffing & Brute Force Attacks
New wave of VPN login attempts targets Palo Alto GlobalProtect portals
Over 10,000 Docker Hub images found leaking credentials, auth keys
Death to one-time text codes: Passkeys are the new hotness • The Register
Social Media
EU fines X $140 million over deceptive blue checkmarks
Regulations, Fines and Legislation
Portugal updates cybercrime law to exempt security researchers
UK finally vows to look at 35-year-old Computer Misuse Act • The Register
Are we mistaking regulation for resilience? | Computer Weekly
Briefing: Online Safety Act Parliamentary Petition Debate | Open Rights Group
What 35 years of privacy law say about the state of data protection - Help Net Security
EU fines X $140 million over deceptive blue checkmarks
Defense bill addresses secure phones, AI training, cyber troop mental health | CyberScoop
UK.gov rejects £1.8B digital ID cost, offers no alternative • The Register
Porn company starts new age checks after £1m fine - BBC News
UK Cyber Security and Resilience Bill: pragmatic overhaul or regulatory overload? | Osborne Clarke
UK ransomware payment ban could ‘significantly shift’ cyber market :: Insurance Day
Uneven regulatory demands expose gaps in mobile security - Help Net Security
Trump Signs Executive Order to Block State AI Regulations - SecurityWeek
‘Report fraud’ service replaces Action Fraud as UK’s official reporting portal
UK ICO Demands “Urgent Clarity” on Facial Recognition Bias Claims - Infosecurity Magazine
Models, Frameworks and Standards
OWASP Project Publishes List of Top Ten AI Agent Threats - Security Boulevard
NIST Plans to Build Threat and Mitigation Taxonomy for AI Agents - Security Boulevard
Porn company starts new age checks after £1m fine - BBC News
Briefing: Online Safety Act Parliamentary Petition Debate | Open Rights Group
Data Protection
What 35 years of privacy law say about the state of data protection - Help Net Security
Cybersecurity Leaders Put Data Protection and Response at the Top of the 2026 Agenda.
Careers, Roles, Skills, Working in Cyber and Information Security
Why An Engineering-Focused CISO Can Be a Liability
Why Losing One Security Engineer Can Break Your Defences | SC Media UK
88% of Cybersecurity Professionals Impacted by Skills Gap
Law Enforcement Action and Take Downs
European cops arrest 193 'violence-as-a-service' suspects • The Register
UK ICO Demands “Urgent Clarity” on Facial Recognition Bias Claims - Infosecurity Magazine
US charges former Accenture employee with misleading feds on cloud platform’s security - Nextgov/FCW
California man admits role in $263 million cryptocurrency theft that funded lavish lifestyle
National cybercrime network operating for 14 years dismantled in Indonesia | TechRadar
Spain arrests teen who stole 64 million personal data records
Myanmar's army says it wants to eradicate scam compounds. Is it really doing that? - BBC News
Poland charges Ukrainians found in possession of hacking equipment | Notes From Poland
US extradites Ukrainian accused of hacking for Russia • The Register
Misinformation, Disinformation and Propaganda
Key barrier to online fraud can be bypassed for pennies, say researchers - CNA
Bots, bias, and bunk: How to tell what's real on the net • The Register
UK on frontline of new information war as Russia floods social media with fake videos - The Mirror
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
NATO prepares for hybrid threats: Alliance Commander-in-Chief reveals details | УНН
Chinese cyberspies target VMware vSphere for long-term persistence | CSO Online
Minister to issue sobering warning about Putin's 'cyber army' in the UK | News UK | Metro News
UK calls on Europe to counter Russia's expanding info wars • The Register
When Do Cyber Campaigns Cross a Line? | Lawfare
EU leaders to push defense readiness amid Russia ‘hybrid attack’ warnings – POLITICO
UK launches hybrid fighting force to secure undersea cables • The Register
How Europe can turn the tide on Russia's underwater warfare
China using cyber weapons for societal havoc, chaos in US | The Jerusalem Post
Ukraine’s wartime experience provides blueprint for infrastructure protection - Atlantic Council
Nation State Actors
Have you been targeted by state-sponsored hackers? Apple, Google issue fresh alerts | Cybernews
China
Chinese cyberspies target VMware vSphere for long-term persistence | CSO Online
Britain sanctions Russian, Chinese entities over disinfo, cyber threats - CNA
React2Shell Vulnerability Under Attack From China-Nexus Groups
2 Men Linked to China’s Salt Typhoon Hacker Group Likely Trained in a Cisco ‘Academy’ | WIRED
Trump prioritizing trade with China over cyber war, Salt Typhoon goes unpunished | Cybernews
China using cyber weapons for societal havoc, chaos in US | The Jerusalem Post
As White House moves to send AI chips to China, Trump’s DOJ prosecutes chip smugglers | CyberScoop
China’s Intelligence Chief Outlines Hardline Five-Year Security Plan - StratNews Global
Russia
Russia’s hybrid warfare puts Europe to the test
Britain sanctions Russian, Chinese entities over disinfo, cyber threats - CNA
NATO prepares for hybrid threats: Alliance Commander-in-Chief reveals details | УНН
Minister to issue sobering warning about Putin's 'cyber army' in the UK | News UK | Metro News
EU leaders to push defense readiness amid Russia ‘hybrid attack’ warnings – POLITICO
UK launches hybrid fighting force to secure undersea cables • The Register
How Europe can turn the tide on Russia's underwater warfare
Ukraine’s wartime experience provides blueprint for infrastructure protection - Atlantic Council
US extradites Ukrainian accused of hacking for Russia • The Register
Tehran and Moscow sign deal on AI, cybersecurity | Iran International
Harbadus attacks Andvaria: cyber war game tests Nato defences against Russia | Nato | The Guardian
Cyber Attack on Reporters Without Borders Linked to Russian Security Services
US Warns of Ongoing Pro-Russia Critical Infrastructure Hacks
Porsche outage in Russia serves as a reminder of the risks in connected vehicle security
Aeroflot hack explained: report says infrastructure was nearly destroyed | Cybernews
Cyberattack Reportedly Paralyzes Russia’s Military Registration Database - The Moscow Times
Iran
US Posts $10 Million Bounty for Iranian Hackers - SecurityWeek
Tehran and Moscow sign deal on AI, cybersecurity | Iran International
MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign
North Korea
React2Shell Exploit Campaigns Tied to North Korean Cyber Tactics - Infosecurity Magazine
North Korean hackers exploit React2Shell flaw in EtherRAT malware attacks
Imposter for hire: How fake people can gain very real access | Microsoft Security Blog
Lazarus Group: The $2.1 Billion Cyber Threat and Your Defense Strategy - Security Boulevard
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Danish intelligence classifies Trump’s America as a security risk – POLITICO
Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery
Predator Spyware Maker Intellexa Evades Sanctions - Infosecurity Magazine
Apple, Google Send New Round of Cyber Threat Notifications to Users
Tools and Controls
Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks
Block all AI browsers for the foreseeable future: Gartner • The Register
Researchers spot 700 percent increase in hypervisor attacks • The Register
Ransomware Targeting Hyper-V and VMware ESXi Surges as Akira Group Exploits System Vulnerabilities
When it comes to security resilience, cheaper isn’t always better | CSO Online
Briefing: Online Safety Act Parliamentary Petition Debate | Open Rights Group
New wave of VPN login attempts targets Palo Alto GlobalProtect portals
Ransomware IAB abuses EDR for stealthy malware execution
Packer-as-a-Service Shanya Hides Ransomware, Kills EDR
DeadLock Ransomware Uses BYOVD to Evade Security Measures - Infosecurity Magazine
NVIDIA research shows how agentic AI fails under attack - Help Net Security
Resilience is the new currency | Professional Security Magazine
CISOs are spending big and still losing ground - Help Net Security
US charges former Accenture employee with misleading feds on cloud platform’s security - Nextgov/FCW
Are we mistaking regulation for resilience? | Computer Weekly
Ransomware gangs turn to Shanya EXE packer to hide EDR killers
MITRE Posts Results of 2025 ATT&CK Enterprise Evaluations - SecurityWeek
Harbadus attacks Andvaria: cyber war game tests Nato defences against Russia | Nato | The Guardian
15 years in, zero trust remains elusive — with AI rising to complicate the challenge | CSO Online
Reports Published in the Last Week
Human-Centric Cyber Risks Surge as AI Enters the Workforce, Report Finds - IT Security Guru
Other News
The hidden dynamics shaping who produces influential cybersecurity research - Help Net Security
Analysts Warn of Cybersecurity Risks in Humanoid Robots
'Botnets in physical form' are top humanoid robot risk • The Register
Need for 'attacking mindset' as major cyber hacks up 50 per cent | In Cumbria
Porn Is Being Injected Into Government Websites Via Malicious PDFs
National Crime Agency leaflet given to pupils linked to 'explicit sexual content' - BBC News
Surviving system meltdowns and cyber attacks - Monevator
Cybersecurity’s New Power Dynamics | Goodwin - JDSupra
‘Report fraud’ service replaces Action Fraud as UK’s official reporting portal
How Can Retailers Cyber-Prepare for the Most Vulnerable Time of the Year?
Cyber risk is the most pressing threat to Irish businesses
Fire Stick users receive warning message while illegally streaming as crackdown begins
Aeroflot hack explained: report says infrastructure was nearly destroyed | Cybernews
Why Singapore remains cautious over naming state actors in cyber-attacks - Yahoo News Singapore
Vulnerability Management
Why bug bounty schemes have not led to secure software | Computer Weekly
MITRE shares 2025's top 25 most dangerous software weaknesses
Vulnerabilities
North Korean hackers exploit React2Shell flaw in EtherRAT malware attacks
React2Shell Vulnerability Under Attack From China-Nexus Groups
Cloudflare blames Friday outage on borked React2shell fix • The Register
Wide Range of Malware Delivered in React2Shell Attacks - SecurityWeek
Attacks pinned to critical React2Shell defect surge, surpass 50 confirmed victims | CyberScoop
Microsoft Patches 57 Vulnerabilities, Three Zero-Days - SecurityWeek
Microsoft releases Windows 10 KB5071546 extended security update
Intel, AMD Processors Affected by PCIe Vulnerabilities - SecurityWeek
React2Shell Exploit Campaigns Tied to North Korean Cyber Tactics - Infosecurity Magazine
Intel, AMD Processors Affected by PCIe Vulnerabilities - SecurityWeek
Ivanti Security Update: Patch for Code Execution Vulnerabilities in Endpoint Manager
Adobe Patches Nearly 140 Vulnerabilities - SecurityWeek
Google fixes eighth Chrome zero-day exploited in attacks in 2025
Google Patches Mysterious Chrome Zero-Day Exploited in the Wild - SecurityWeek
Google Fixes Gemini Enterprise Flaw That Exposed Corporate Data - Infosecurity Magazine
Microsoft won’t fix .NET RCE bug affecting enterprise apps • The Register
This 30-year-old app is somehow still one of the biggest security risks on Windows
IBM Patches Over 100 Vulnerabilities - SecurityWeek
Microsoft Outlook Vulnerability Let Attackers Execute Malicious Code Remotely
Maximum-severity XXE vulnerability discovered in Apache Tika
Apache warns of 10.0-rated flaw in Tika metadata toolkit • The Register
Fortinet warns of critical FortiCloud SSO login auth bypass flaws
SAP fixes three critical vulnerabilities across multiple products
Firefox 146 adds Windows backup, improved privacy, and security fixes | PCWorld
Critical Gogs zero-day under attack, 700 servers hacked
Hackers Actively Exploiting ArrayOS AG VPN Vulnerability to Deploy Webshells
Hackers abuse Notepad++ updater | Cybernews
Warning: WinRAR Vulnerability CVE-2025-6218 Under Active Attack by Multiple Threat Groups
Google Fortifies Chrome Agentic AI Against Indirect Prompt Injection Attacks - SecurityWeek
700+ self-hosted Git instances battered in 0-day attacks • The Register
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Advisory 10 December 2025 - Security Updates from Microsoft, SAP, Adobe, Fortinet, Google Android, Ivanti, React.js
Black Arrow Cyber Advisory 10 December 2025 - Security Updates from Microsoft, SAP, Adobe, Fortinet, Google Android, Ivanti, React.js
Executive Summary
This month’s Patch Tuesday brings a very busy close to the year, with Microsoft fixing 57 vulnerabilities, SAP issuing 14 new security notes, Adobe addressing nearly 140 issues, and Google Android resolving 107 flaws including two actively exploited zero days. Fortinet, Ivanti and React have all released targeted updates for critical remotely exploitable weaknesses in network infrastructure, endpoint management and widely used web frameworks. Organisations should prioritise internet facing services, identity and SSO paths, and any platform exposed to untrusted content or code.
Vulnerabilities by Vendor
Microsoft: 57 vulnerabilities, affecting Windows client and server, Office, Azure components, developer tooling (including GitHub Copilot for JetBrains) and PowerShell.
SAP: 14 vulnerabilities, affecting Solution Manager, Commerce Cloud, jConnect, Web Dispatcher and Internet Communication Manager, NetWeaver, Business Objects, S/4HANA Private Cloud, SAPUI5 and Enterprise Search.
Adobe: At least 138 vulnerabilities across ColdFusion, Adobe Experience Manager (AEM), DNG SDK, Acrobat/Reader and Creative Cloud Desktop. ColdFusion and AEM carry multiple critical or high severity issues, including arbitrary code execution and extensive cross site scripting in AEM.
Fortinet: At least 4 vulnerabilities, affecting FortiOS, FortiProxy, FortiWeb and FortiSwitchManager, including two critical flaws in FortiCloud SSO login that allow administrative authentication bypass, plus additional weaknesses in password handling and credential reset flows.
Google Android: 107 vulnerabilities, affecting Android Framework and System components (51 flaws) and kernel and closed source vendor components (56 flaws) across Android 13 to 16. Two high severity issues are under active exploitation, with an additional critical denial of service flaw in the Android Framework and multiple critical elevation of privilege bugs in kernel subcomponents and chipset drivers.
Ivanti: 1 vulnerability, affecting Ivanti Endpoint Manager (EPM) 2024, disclosed as part of Ivanti’s December 2025 security update. Public commentary indicates a critical stored cross site scripting issue that can lead to remote code execution within the management console.
React: 1 vulnerability, affecting React Server Components in React 19 (react-server and related packages) and widely used frameworks that integrate the same protocol. This unauthenticated remote code execution flaw, widely referred to as React2Shell, is already under active exploitation and carries maximum severity. Prioritise updating to the patched React and framework versions recommended in the React advisory, with particular urgency for internet facing applications and multi tenant environments. Please see our specific advisory on this vulnerability for more information: https://www.blackarrowcyber.com/blog/advisory-08-december-2025-react2shell
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
Sources:
1 Microsoft — https://msrc.microsoft.com/update-guide/releaseNote/2025-Dec
2 SAP — https://support.sap.com/en/my-support/knowledge-base/security-notes-news/december-2025.html
3 Adobe — https://helpx.adobe.com/security.html
4 Fortinet — https://fortiguard.fortinet.com/psirt/FG-IR-25-647
5 Google Android — https://source.android.com/docs/security/bulletin/2025-12-01
6 Ivanti — https://www.ivanti.com/blog/december-2025-security-update
7 React — https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Black Arrow Cyber Advisory - 08 December 2025 – React2Shell Vulnerability Actively Exploited in Web Technologies
Black Arrow Cyber Advisory - 08 December 2025 – React2Shell Vulnerability Actively Exploited in Web Technologies
Executive summary
A critical security flaw, widely known as React2Shell (CVE-2025-55182), has been identified in a very popular web technology used to build modern online services and software platforms. It has a maximum severity rating and allows attackers to run code on affected servers without needing to log in.
The issue mainly affects organisations that develop and host their own modern web applications using React Server Components and certain versions of Next.js, rather than traditional off the shelf software. However, many SaaS and cloud based services are built on these technologies, so the most realistic risk for many organisations is through their critical third parties and suppliers, rather than their own internal systems.
The vulnerability is already being actively exploited, has been added to CISA’s Known Exploited Vulnerabilities catalogue, and security researchers report tens of thousands of potentially exposed systems and confirmed breaches at multiple organisations.
In practical terms, this is another supply chain and SaaS platform risk that boards and senior leaders should be aware of, particularly where critical business processes rely on externally hosted web applications.
What is the risk to me or my business?
For most organisations who do not carry out development activites, the main concerns are:
Trusted third party services
Business critical SaaS platforms such as HR, payroll, finance, CRM, ticketing, collaboration, sector specific tools, may use the affected web technology as part of their platform. If one of these suppliers is compromised, attackers may be able to access or steal your data held in that service, or disrupt availability.
Customer facing websites and portals built by third parties
Public websites, customer portals and booking or payment systems developed by digital agencies may be using the affected components.
Regulatory and reputational impact:
Exploitation is being linked to capable threat actors and is already being used to steal data at scale. A compromise at a key supplier could still create regulatory reporting, contractual and reputational consequences for your organisation, even if the issue sits in their technology stack.
By contrast, organisations that only use React in the form of older or simple front end websites, or who do not use React based web technologies at all, will likely have limited direct technical exposure. However, almost every organisation consumes multiple SaaS platforms, and those are where the risk is most likely to materialise.
Technical Summary
CVE-2025-55182 (React2Shell): A pre authentication remote code execution vulnerability in React Server Components, caused by unsafe deserialisation of attacker controlled data in the RSC “Flight” protocol.
Affects versions 19.0.0, 19.1.0, 19.1.1 and 19.2.0 of:
react-server-dom-webpack
react-server-dom-parcel
react-server-dom-turbopack
CVE-2025-66478 (Next.js): Tracks the downstream impact on Next.js applications using the App Router, which depend on the vulnerable RSC implementation.
This vulnerability has also been rated as a CVSS 10.0 and can lead to RCE when processing crafted requests in unpatched environments.
Exploitation status
CISA has added CVE-2025-55182 to the KEV catalogue following evidence of active exploitation. Rapid7, Tenable and others note public proof of concept exploits, including a Metasploit module, and rapid adoption by threat actors. Amazon’s security team has observed exploitation attempts by China state linked groups within hours of public disclosure.
Patched versions
React has released fixes in react-server-dom-* versions 19.0.1, 19.1.2 and 19.2.1
Next.js has released patched versions for affected major branches under CVE-2025-66478, and advises upgrading to the latest available release in the relevant major line.
What types of software are most likely to be affected?
Based on current public reporting and vendor advisories, the typical affected services are:
Custom built web applications and portals: Customer portals, online account management, booking systems and ecommerce sites built using modern React and Next.js frameworks.
Modern SaaS and cloud based platforms: Many contemporary SaaS products use these frameworks to build their web dashboards and user interfaces. Where those services have not yet patched, they may be exposed.
Tech and digital firms that develop software as their core business: These organisations are more likely to have adopted the latest React 19 and Next.js capabilities and will be prioritising patching efforts now.
Traditional enterprise software suites and legacy on premises tools are less likely to be using this particular technology stack. The risk profile therefore looks very similar to other supply chain related events: a serious flaw in widely used underlying technology, with real impact flowing through service providers and suppliers.
What can I do?
As the situation is still evolving and technical guidance is being updated frequently, we recommend leadership teams focus on four practical actions, and refer technical teams to the detailed references below.
Understand where you might be exposed indirectly
Identify your most critical SaaS and hosted platforms (for example HR and payroll, finance, CRM, key industry platforms).
Ask suppliers directly whether they have assessed their exposure to React2Shell CVE-2025-55182 and Next.js CVE-2025-66478, and whether they have applied the recommended patches.
Check any externally hosted websites or portals in your name
Where third party developers or agencies maintain your customer facing portals or transactional sites, seek written confirmation that they have reviewed their use of React and Next.js and applied relevant updates where required.
Ensure monitoring and incident response are ready
Ask your internal or external security and IT teams to confirm they are:
Tracking authoritative advisories on React2Shell.
Monitoring for unusual access patterns or alerts on key SaaS platforms and externally facing web applications.
Keep an eye on evolving guidance
This is a fast moving issue, with new detection methods and defensive advice being published by major vendors and government agencies. Leaders should ensure their organisations are:
Following updates from suppliers and cloud providers.
Prepared to act quickly if a critical third party discloses that they have been impacted.
For organisations that do build or host their own web applications, your internal or outsourced development teams should follow the technical instructions in the React and Next.js advisories without delay.
Further details and patches
For technical teams and suppliers, current authoritative sources include:
React: Official security advisory on the critical vulnerability in React Server Components and patched versions: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Next.js: Security advisory for CVE-2025-66478: https://nextjs.org/blog/CVE-2025-66478
CERT EU: technical advisory on CVE-2025-55182 and recommended updates: https://cert.europa.eu/publications/security-advisories/2025-041/pdf
Tenable: https://www.tenable.com/blog/react2shell-cve-2025-55182-react-server-components-rce
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Intelligence Briefing 05 December 2025
Black Arrow Cyber Threat Intelligence Briefing 05 December 2025:
-Are MSPs the Weakest Link in Your Security Chain?
-Marquis Data Breach Impacts Over 74 US Banks, Credit Unions
-Stealthy Browser Extensions Waited Years Before Infecting 4.3M Chrome, Edge Users With Backdoors and Spyware
-How Financial Institutions Can Future-Proof Their Security Against a New Breed of Cyber Attackers
-Malicious LLMs Empower Inexperienced Hackers with Advanced Tools
-Companies Fear State Attacks More as Threat Landscape Evolves
-Spear Phishing is North Korean Hackers’ Top Tactic: How to Stay Safe
-CISOs, CIOs and Boards: Bridging the Cyber Security Confidence Gap
-Disinformation and Cyber Threats Expand Globally
-Cyber Attacks Among Biggest Risks to Financial Stability, Bank Chief Warns
-NATO May Get 'More Aggressive' in Countering Russia’s Hybrid Attacks, Top Military Official Says
-Ex Teen Hackers Warn Parents Are Clueless as Children Steal 'Millions'
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
Recent high profile cyber incidents have highlighted how organisations need to address the risks presented by their third parties, including their managed service provider (MSP), and this week’s review of threat intelligence highlights two impactful examples. We discuss other business risks identified from our review, including the long term tactics of attackers and the malicious use of AI.
These illustrate the need for business leaders to upskill themselves on their cyber literacy, to ask the appropriate challenging questions on the risks to their business. It is important that the upskilling should be from an impartial source, not from a control provider such as the MSP, in order to achieve a broad and objective perspective.
Our review also shows the need for the leadership team to have meaningful conversations with their CISO, and to provide the appropriate support and challenge. Contact us to discuss how we support business leaders and decision makers to understand and manage their cyber risks in a proportionate manner.
Top Cyber Stories of the Last Week
Are MSPs the Weakest Link in Your Security Chain?
A series of incidents affecting Jaguar Land Rover, the Coop Group and Marks and Spencer were linked to compromises at a managed service provider (MSP) where attackers used simple social engineering to obtain helpdesk access. The article notes regulator fines of £14m against a large outsourcer (Capita) and estimates that related breaches could cost close to £2bn, underlining MSPs as high concentration risks.
Source: https://www.techmonitor.ai/technology/cybersecurity/msps-cybersecurity-risk
Marquis Data Breach Impacts Over 74 US Banks, Credit Unions
A ransomware attack on Marquis Software Solutions shows how a breach at a single service provider can affect many financial institutions. The incident exposed data belonging to more than 74 banks and credit unions and over 400,000 individuals. Attackers exploited a SonicWall firewall to steal names, contact details, Social Security numbers and financial account information.
Source: https://www.bleepingcomputer.com/news/security/marquis-data-breach-impacts-over-74-us-banks-credit-unions/
Stealthy Browser Extensions Waited Years Before Infecting 4.3M Chrome, Edge Users With Backdoors and Spyware
A long running campaign by attackers called ‘ShadyPanda’ used legitimate looking Chrome and Edge extensions to build a large user base before adding malicious updates. More than 4.3 million users were affected and several extensions remained available in official stores. The extensions included backdoors, surveillance tools and remote code execution, demonstrating the risk of trusted browser add-ons.
Source: https://www.theregister.com/2025/12/01/chrome_edge_malicious_browser_extensions/
How Financial Institutions Can Future-Proof Their Security Against a New Breed of Cyber Attackers
Financial institutions face increasingly organised adversaries supported by AI, initial access brokers who gain entry to victim organisations, and complex supply chains. Digital footprints have expanded and identity controls remain a common weakness. The article sets out the need for continuous external attack surface monitoring, AI governance, stronger authentication and closer coordination between cyber security, fraud teams and business leaders.
Source: https://securityboulevard.com/2025/12/how-financial-institutions-can-future-proof-their-security-against-a-new-breed-of-cyber-attackers/
Malicious LLMs Empower Inexperienced Hackers With Advanced Tools
Researchers tested large language models (LLMs) used by attackers such as WormGPT 4 and KawaiiGPT, and found they reliably generate working ransomware scripts, lateral movement tooling and polished phishing emails. WormGPT 4 is sold for $50 a month or a $220 lifetime fee, while free KawaiiGPT helps automate phishing and scripting. These LLMs enable inexperienced attackers by generating functional malware and phishing content.
Source: https://www.bleepingcomputer.com/news/security/malicious-llms-empower-inexperienced-hackers-with-advanced-tools/
Companies Fear State Attacks More as Threat Landscape Evolves
Research shows most UK and US cyber security managers are worried about state sponsored attacks, with 23% citing inadequate preparedness for geopolitical escalation as their top concern. Respondents point to rising activity from Russia, Iran, North Korea and China, and 33% believe government support is insufficient. Many fear data loss, reputational harm and supply chain disruption, but 74% are investing in resilience measures.
Source: https://www.infosecurity-magazine.com/news/companies-fear-state-attacks-more/
Spear Phishing Is North Korean Hackers’ Top Tactic: How To Stay Safe
Analysis of recent incidents shows North Korea’s Lazarus Group continues to rely on targeted spear phishing, often using job approaches or academic invitations to gain access to finance, crypto, defence and IT organisations. Lazarus appeared in 31 reports this year, the highest among North Korean groups. The article highlights the need for vigilance, MFA and stronger controls to reduce account compromise.
Source: https://cointelegraph.com/news/spear-phishing-north-korean-hackers-top-tactic-how-to-stay-safe
CISOs, CIOs and Boards: Bridging the Cyber Security Confidence Gap
Survey data shows most board members lack confidence in decisions on cyber investment and struggle to connect technical performance with business outcomes. Security leaders are encouraged to translate blocked threats into avoided financial impact, communicate in risk terms rather than technical language, and demonstrate how identity and resilience measures directly support business goals.
Source: https://securityboulevard.com/2025/12/cisos-cios-and-boards-bridging-the-cybersecurity-confidence-gap/
Disinformation and Cyber Threats Expand Globally
A World Economic Forum survey of 11,000 executives across 116 economies shows cyber insecurity and the adverse outcomes of AI are emerging as leading risks for major economies. Executives warn that AI is increasing attacker capability in social engineering, reconnaissance and exploit development. Many also fear malicious use of AI tools and attacks such as data poisoning.
Source: https://www.infosecurity-magazine.com/news/disinformation-cyberthreats-global/
Cyber Attacks Among Biggest Risks to Financial Stability, Bank Chief Warns
The Bank of England reports cyber attacks are now among the most significant risks to UK financial stability, with firms increasingly citing them alongside geopolitical and economic pressures. The Bank of England’s Governor warns that disruption to digital services or payments could quickly erode confidence in the financial system. Firms are urged to strengthen resilience as dependency on digital infrastructure grows.
Source: https://www.independent.co.uk/news/uk/politics/bank-of-england-jaguar-land-rover-spencer-andrew-bailey-b2876526.html
NATO May Get 'More Aggressive' in Countering Russia’s Hybrid Attacks, Top Military Official Says
NATO is considering more proactive responses to Russian hybrid operations following cyber activity and infrastructure interference across Europe. Its Military Committee chair notes that certain offensive cyber measures may be justified as defensive action. Recent patrols over seabed cables under Baltic Sentry exercises have reduced incidents of damage to the cables, showing how visible deterrence can help counter covert disruption.
Source: https://kyivindependent.com/nato-may-get-more-aggressive-in-countering-russias-hybrid-attacks-top-military-official-tells-ft/
Ex Teen Hackers Warn Parents Are Clueless as Children Steal 'Millions'
The UK National Crime Agency’s ‘Cyber Choices programme’ aims to divert young people away from illegal cyber activity and guide them toward safe, legal and productive uses of their technical skills. Referrals now include children as young as seven, with the average age at 15. Many cases relate to gaming communities and capability development among 10- to 16-year-olds, and former crypto hackers warn that teenagers are making millions from online crime unnoticed by parents or schools.
Source: https://news.sky.com/story/children-as-young-as-seven-caught-hacking-as-former-cybercriminals-warn-its-mainstream-now-13479365
Governance, Risk and Compliance
Disinformation and Cyber-Threats Top Global Exec Concerns - Infosecurity Magazine
CISOs, CIOs and Boards: Bridging the Cybersecurity Confidence Gap - Security Boulevard
Are MSPs the weakest link in your security chain? - Tech Monitor
Insurer pulls back from cyber market amid rising hacks and price war
How headlines can drive change in cyber security | Computer Weekly
12 signs the CISO-CIO relationship is broken — and steps to fix it | CSO Online
Every risk matters: How foresight can save firms before disaster hits - The Standard
Why compliance alone can’t keep pace with today’s cyber threats - Tech Monitor
The Great Disconnect: Unmasking the 'Two Separate Conversations' in Security - SecurityWeek
Sleepless in Security: What’s Actually Keeping CISOs Up at Night - Security Boulevard
Criminals turning bank security systems against themselves
ISC2 Study Finds Cybersecurity Budget Constraints Remain, But Do Not Worsen, While Skill Needs Grow
CISOs are questioning what a crisis framework should look like - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
SonicWall ransomware attacks offer an M&A lesson for CSOs | CSO Online
Cyber insurers brace for more ransomware as soft market drags on | Insurance Business
Deep dive into DragonForce ransomware and its Scattered Spider connection
Zendesk users targeted by Scattered Lapsus$ Hunters hackers and fake support sites | TechRadar
Global ransomware threat rises as soft market persists :: Insurance Day
The Ransomware Holiday Bind: Burnout or Be Vulnerable
Ransomware Moves: Supply Chain Hits, Credential Harvesting
UK Ransomware Payment Ban to Come with Exemptions - Infosecurity Magazine
How a noisy ransomware intrusion exposed a long-term espionage foothold - Help Net Security
Ransomware Victims
Researcher tricks Claude into deploying MedusaLocker ransomware: Exclusive
Weaponizing Claude Skills with MedusaLocker | Cato Networks
E-tailer resumes sales 45 days after ransomware attack • The Register
UPenn joins long list of Clop victims after Oracle EBS raid • The Register
ASUS confirms vendor breach as Everest gang leaks data, claims ArcSoft and Qualcomm
Phishing & Email Based Attacks
Threat Actors Exploit Calendar Subscriptions for Phishing and Malware - Infosecurity Magazine
North Korea Lazarus Group Tops Cyber Threats with Spear Phishing Attacks
New GhostFrame Phishing Framework Hits Over One Million Attacks - Infosecurity Magazine
Fake Calendly invites spoof top brands to hijack ad manager accounts
How Threat Actors Engineer Attacks to Evade Email Security US | Proofpoint US
SMS Phishers Pivot to Points, Taxes, Fake Retailers – Krebs on Security
Reporters Without Borders Targeted by Russian Hackers - SecurityWeek
Other Social Engineering
Fake Calendly invites spoof top brands to hijack ad manager accounts
SMS Phishers Pivot to Points, Taxes, Fake Retailers – Krebs on Security
North Korea lures engineers to rent identities in fake IT worker scheme
Researchers Capture Lazarus APT's Remote-Worker Scheme Live on Camera
Fraud, Scams and Financial Crime
How Southeast Asia Became the Scam Capital of the World – The Diplomat
Fake AI-generated shops, ads are flourishing on Facebook | Mashable
Upbit Confirms $37 Million Solana Hack, Pledges Full Customer Reimbursement
Artificial Intelligence
Researcher tricks Claude into deploying MedusaLocker ransomware: Exclusive
AI 2030: The Coming Era of Autonomous Cyber Crime | MSSP Alert
Malicious LLMs empower inexperienced hackers with advanced tools
Weaponized AI Is Changing The Vulnerability Management Game. Now What?
Fake AI-generated shops, ads are flourishing on Facebook | Mashable
Microsoft Issues Warning To Windows 11 Users - This AI Feature Can Install Viruses
Attackers keep finding new ways to fool AI - Help Net Security
Critical PickleScan Vulnerabilities Expose AI Model Supply Chains - Infosecurity Magazine
Japan issues arrest warrant against teen suspected of cyberattack using AI
ChatGPT went down worldwide, conversations dissapeared for users
AML/CFT/Money Laundering/Terrorist Financing/Sanctions
Europol Takes Down Illegal Cryptocurrency Mixing Service - Infosecurity Magazine
Malware
Browser extensions pushed malware to 4.3M Chrome, Edge users • The Register
Threat Actors Exploit Calendar Subscriptions for Phishing and Malware - Infosecurity Magazine
Chrome, Edge Extensions Caught Tracking Users, Creating Backdoors - SecurityWeek
“Sleeper” browser extensions woke up as spyware on 4 million devices | Malwarebytes
Newly discovered malicious extensions could be lurking in enterprise browsers | CSO Online
Microsoft Issues Warning To Windows 11 Users - This AI Feature Can Install Viruses
Dead Man's Switch - Widespread npm Supply Chain Attack Driving Malware Attacks
Contagious Interview campaign expands with 197 npm Ppackages spreading new OtterCookie malware
Glassworm malware returns in third wave of malicious VS Code packages
Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor
The most prominent infostealers and how businesses can protect against them | IT Pro
Bots/Botnets
Record 29.7 Tbps DDoS Attack Linked to AISURU Botnet with up to 4 Million Infected Hosts
Why the Record-Breaking 30 Tbps DDoS Attack Should Concern Every Business | Fortra
Mobile
New Albiriox MaaS Malware Targets 400+ Apps for On-Device Fraud and Screen Control
Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild
Two Android 0-day bugs patched, plus 105 more fixes • The Register
A new Android malware sneakily wipes your bank account
Predator spyware uses new infection vector for zero-click attacks
CISA Issues Alert on Cyber Threat Actors Spyware Use
Google's new Android 16 upgrades make a strong case for sticking with Pixel or Samsung | ZDNET
India ready to change state-run security app order after outcry | The Straits Times
Israel’s IDF Bans Android Phones—iPhones Now ‘Mandatory’
Feds Warn iPhone And Android Users—Stop Using Your VPN
Denial of Service/DoS/DDoS
Record 29.7 Tbps DDoS Attack Linked to AISURU Botnet with up to 4 Million Infected Hosts
Why the Record-Breaking 30 Tbps DDoS Attack Should Concern Every Business | Fortra
Criminals turning bank security systems against themselves
Internet of Things – IoT
Hundreds of Porsche Owners in Russia Unable to Start Cars After System Failure - The Moscow Times
Four arrested in South Korea over IP camera spying spree • The Register
You've Heard About Smart Home Hacking: Here's How It Works and How Likely It Is - CNET
Man behind in-flight Evil Twin WiFi attacks gets 7 years in prison
Data Breaches/Leaks
Marquis data breach impacts over 74 US banks, credit unions
London cyber attack latest as council confirms some data 'copied and taken away' - My London
OpenAI Confirms Data Breach—Here's Who Is Impacted - Decrypt
Security Leaders Discuss SitusAMC Cyberattack | Security Magazine
Post Office Escapes £1m Fine After Postmaster Data Breach - Infosecurity Magazine
Brsk confirms breach as bidding begins for 230K+ records • The Register
FBI Veteran Says Chinese Cyberattack Monitored Every American Citizen's Movements for Five Years
Attackers stole member data from French Soccer Federation
South Korea's Coupang admits breach exposed 33.7M users • The Register
ASUS confirms vendor breach as Everest gang leaks data, claims ArcSoft and Qualcomm
OBR drags in cyber bigwig after Budget leak blunder • The Register
Hackers Allegedly Claim Breach of Mercedes-Benz USA Legal and Customer Data
OBR chief Richard Hughes resigns after budget leak investigation | Politics News | Sky News
Organised Crime & Criminal Actors
AI 2030: The Coming Era of Autonomous Cyber Crime | MSSP Alert
Malicious LLMs empower inexperienced hackers with advanced tools
How Southeast Asia Became the Scam Capital of the World – The Diplomat
Global law enforcement actions put pressure on cybercrime networks - Help Net Security
Cybercrime Goes SaaS: Renting Tools, Access, and Infrastructure
Japan issues arrest warrant against teen suspected of cyberattack using AI
Dutch study finds teen cybercrime is mostly just a phase • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Law Enforcement shuts down Cryptomixer in major crypto crime takedown
Europol Takes Down Illegal Cryptocurrency Mixing Service - Infosecurity Magazine
Upbit Confirms $37 Million Solana Hack, Pledges Full Customer Reimbursement
North Korea’s Lazarus Group Suspected in $30M Upbit Hack, Raising Security Alarms
Insider Risk and Insider Threats
North Korea lures engineers to rent identities in fake IT worker scheme
Researchers Capture Lazarus APT's Remote-Worker Scheme Live on Camera
When Hackers Wear Suits: Protecting Your Team from Insider Cyber Threats
Insurance
Cyber insurers brace for more ransomware as soft market drags on | Insurance Business
Insurer pulls back from cyber market amid rising hacks and price war
Cyber insurance struggles to keep pace with rising exposures | Insurance Business
Cyber risks are growing but businesses are shunning cover
Supply Chain and Third Parties
Marquis data breach impacts over 74 US banks, credit unions
Are MSPs the weakest link in your security chain? - Tech Monitor
Ransomware Moves: Supply Chain Hits, Credential Harvesting
UPenn joins long list of Clop victims after Oracle EBS raid • The Register
MoD updates cyber security requirements for suppliers | UKAuthority
Software Supply Chain
Dead Man's Switch - Widespread npm Supply Chain Attack Driving Malware Attacks
PostHog admits Shai-Hulud 2.0 was its biggest security scare • The Register
Contagious Interview campaign expands with 197 npm Ppackages spreading new OtterCookie malware
Cloud/SaaS
Cybercrime Goes SaaS: Renting Tools, Access, and Infrastructure
'Exploitation is imminent' of max-severity React bug • The Register
Swiss government bans SaaS and cloud for sensitive info • The Register
How Threat Actors Engineer Attacks to Evade Email Security US | Proofpoint US
Outages
ChatGPT went down worldwide, conversations dissapeared for users
Cloudflare blames outage on emergency React2Shell patch
Encryption
The quantum clock is ticking and businesses are still stuck in prep mode - Help Net Security
Q&A on the next big cyber threat: Post-quantum cryptography | SC Media
Passwords, Credential Stuffing & Brute Force Attacks
Ransomware Moves: Supply Chain Hits, Credential Harvesting
Social Media
Fake AI-generated shops, ads are flourishing on Facebook | Mashable
We have to be able to hold tech platforms accountable for fraud
Meta must rein in scammers — or face consequences | The Verge
Regulations, Fines and Legislation
UK's Cyber Bill should be just one part of a wider effort | Computer Weekly
UK Ransomware Payment Ban to Come with Exemptions - Infosecurity Magazine
US Slashes Pay Incentives at Already Weakened Cyber Agency
Five-page draft Trump administration cyber strategy targeted for January release | CyberScoop
GSMA grapples with cybersecurity rules
Models, Frameworks and Standards
NIS2 proposed to be implemented in Swedish Law by “Cybersecurity Act”
NIS2 in the Baltics: Strengthening Cyber Resilience
Data Protection
Post Office Escapes £1m Fine After Postmaster Data Breach - Infosecurity Magazine
Careers, Working in Cyber and Information Security
ISC2 Study Finds Cybersecurity Budget Constraints Remain, But Do Not Worsen, While Skill Needs Grow
Skills Shortages Trump Headcount as Critical Cyber Challenge - Infosecurity Magazine
Law Enforcement Action and Take Downs
Europol Takes Down Illegal Cryptocurrency Mixing Service - Infosecurity Magazine
Global law enforcement actions put pressure on cybercrime networks - Help Net Security
Hybrid attacks against Europe: Russian hacker detained in Poland - CPD | УНН
Japan issues arrest warrant against teen suspected of cyberattack using AI
Four arrested in South Korea over IP camera spying spree • The Register
Man behind in-flight Evil Twin WiFi attacks gets 7 years in prison
Australian Man Sentenced to Prison for Wi-Fi Attacks at Airports and on Flights - SecurityWeek
Dutch study finds teen cybercrime is mostly just a phase • The Register
Misinformation, Disinformation and Propaganda
Disinformation and Cyber-Threats Top Global Exec Concerns - Infosecurity Magazine
Russia’s information war 2025: disinformation as an operational weapon
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
NATO may get 'more aggressive' in countering Russia’s hybrid attacks, top military official says
Russia’s information war 2025: disinformation as an operational weapon
Offensive cyber power is spreading fast and changing global security - Help Net Security
Most Companies Fear State-Sponsored Cyber-Attacks - Infosecurity Magazine
Hybrid attacks against Europe: Russian hacker detained in Poland - CPD | УНН
How a noisy ransomware intrusion exposed a long-term espionage foothold - Help Net Security
Cyber warfare in space: attacks on space systems rose during Gaza conflict, report finds | Euronews
How much should the UK worry about cyberattacks? | British Politics and Policy at LSE
Nation State Actors
Offensive cyber power is spreading fast and changing global security - Help Net Security
Most Companies Fear State-Sponsored Cyber-Attacks - Infosecurity Magazine
Chinese Front Companies Providing Advanced Steganography Solutions for APT Operations
State-sponsored cyber threat fears surge - CIR Magazine
China
Chinese Front Companies Providing Advanced Steganography Solutions for APT Operations
CISA warns of Chinese "BrickStorm" malware attacks on VMware servers
FBI Veteran Says Chinese Cyberattack Monitored Every American Citizen's Movements for Five Years
State-sponsored cyber threat fears surge - CIR Magazine
China Researches Ways to Disrupt Satellite Internet
Nexperia warns carmakers of factory shutdowns amid Dutch-Chinese row
US Telecoms Reject Regulation as Answer to Chinese Hacking
SMS Phishers Pivot to Points, Taxes, Fake Retailers – Krebs on Security
Russia
NATO may get 'more aggressive' in countering Russia’s hybrid attacks, top military official says
Russia’s information war 2025: disinformation as an operational weapon
Hybrid attacks against Europe: Russian hacker detained in Poland - CPD | УНН
Reporters Without Borders Targeted by Russian Hackers - SecurityWeek
Russia blocks Roblox over distribution of LGBT "propaganda"
SpaceX removes Russian cosmonaut from mission over national security concerns | The Independent
Russia blocks FaceTime and Snapchat for alleged use by terrorists
Hundreds of Porsche Owners in Russia Unable to Start Cars After System Failure - The Moscow Times
Iran
Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor
North Korea
We need to finally take the North Korean threat seriously
North Korea lures engineers to rent identities in fake IT worker scheme
Researchers Capture Lazarus APT's Remote-Worker Scheme Live on Camera
North Korea Lazarus Group Tops Cyber Threats with Spear Phishing Attacks
State-sponsored cyber threat fears surge - CIR Magazine
North Korea Suspected of $30 Million Crypto Hack, Yonhap Says - Bloomberg
North Korean hackers suspected in dozens of cyberattacks over past year
Upbit Confirms $37 Million Solana Hack, Pledges Full Customer Reimbursement
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Pall Mall Process to Define Responsible Commercial Cyber Intrusion - Infosecurity Magazine
Tools and Controls
Are MSPs the weakest link in your security chain? - Tech Monitor
Cyber insurance struggles to keep pace with rising exposures | Insurance Business
ISC2 Study Finds Cybersecurity Budget Constraints Remain, But Do Not Worsen, While Skill Needs Grow
Why compliance alone can’t keep pace with today’s cyber threats - Tech Monitor
How threat intelligence builds shared responsibility in cybersecurity | SC Media
Akamai Study Shows Microsegmentation Boosts Security
Cyber risks are growing but businesses are shunning cover
Key questions CISOs must ask before adopting AI-enabled cyber solutions | CSO Online
Feds Warn iPhone And Android Users—Stop Using Your VPN
CISOs are questioning what a crisis framework should look like - Help Net Security
Other News
Cyber attacks among biggest risks to financial stability, Bank chief warns | The Independent
Police consider corporate manslaughter charges in Post Office scandal - BBC News
How much should the UK worry about cyberattacks? | British Politics and Policy at LSE
UK Warns Small Firms to Boost Cyber Defences Amid Rising Threats | EasternEye
G7 Unveils New Cybersecurity Guidelines
UK national security strategy failing to account for online world | Computer Weekly
Criminals turning bank security systems against themselves
How to build forward-thinking cybersecurity teams for tomorrow | Microsoft Security Blog
North American firms are unprepared for rising risk pressures, HUB warns | Insurance Business
Cybersecurity Through the Telecom Stack: Where Attacks Happen and How to Fight Back
A day in the life of the internet tells a bigger story - Help Net Security
Vulnerability Management
Weaponized AI Is Changing The Vulnerability Management Game. Now What?
Rethinking Vulnerability Management | MSSP Alert
Vulnerabilities
Microsoft Silently Patches Windows LNK Flaw After Years of Active Exploitation
Microsoft Patched Windows LNK Vulnerability Exploited by Hackers in the Wild as 0-Day
'Exploitation is imminent' of max-severity React bug • The Register
Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild
SonicWall ransomware attacks offer an M&A lesson for CSOs | CSO Online
PoC Exploit Released for Critical Outlook 0-Click Remote Code Execution Vulnerability
Chrome 143 Patches High-Severity Vulnerabilities - SecurityWeek
Critical React, Next.js flaw lets hackers execute code on servers
Critical PickleScan Vulnerabilities Expose AI Model Supply Chains - Infosecurity Magazine
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 28 November 2025
Black Arrow Cyber Threat Intelligence Briefing 28 November 2025:
-M&A Risk: Ransomware Hackers Attack SMBs Being Acquired to Try and Gain Access to Multiple Companies
-CrowdStrike Catches Insider Feeding Information to Hackers
-A Third of Workers Risk Cyber Security Breach by Using Work Devices for Personal Use
-Shadow AI Security Breaches Will Hit 40% of All Companies by 2030, Warns Gartner
-New (ISC)2 Report Finds That Vendor Security Gaps Threaten Critical Infrastructure and Supply Chains
-A Fake Windows Update Screen Is Fooling Windows Users into Installing Malware
-FBI: Cybercriminals Stole $262 Million by Impersonating Bank Support Teams Since January
-Compromised Credentials Responsible for 50% of Ransomware Attacks
-Russian and North Korean Hackers Form Alliances
-Alliances Between Ransomware Groups Tied to Recent Surge in Cybercrime
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week we start with an alert on the cyber security risks of mergers and acquisitions: attackers are found to have entered the networks of companies that are later acquired by another organisation, allowing the attackers to enter the acquiring organisation also.
We highlight insider-risks that business leaders should be aware of, including employees who are bribed by attackers, employees using work devices for personal use, and employees using shadow AI. Attacker tactics in this week’s review include attacks via third parties, fake Windows update screens, impersonating the support teams of banks, and using compromised credentials to inflict ransomware attacks. We also see greater collaboration and alliances by attacker groups.
A key part of building stronger cyber security and resilience is understanding how attackers are evolving their tactics. This threat intelligence empowers you to objectively assess how your organisation is susceptible to these tactics and what you need to do to enhance your own security. We strongly recommend that threat intelligence should feature in your leadership training, your incident response exercise and your governance papers; contact us to discuss how we can help you achieve this in a proportionate way.
Top Cyber Stories of the Last Week
M&A Risk: Ransomware Hackers Attack SMBs Being Acquired to Try and Gain Access to Multiple Companies
Research describes how ransomware actors focus on smaller firms that are likely acquisition targets. By compromising SonicWall devices and leaving backdoors in place, the attackers can pivot into larger enterprises once deals complete, often without the parent organisation realising these assets exist. The pattern underlines the importance of thorough asset discovery, credential hygiene and security reviews before and immediately after acquisitions.
CrowdStrike Catches Insider Feeding Information to Hackers
CrowdStrike confirmed that a now terminated insider secretly shared screenshots of internal systems with cyber attackers called the Scattered Lapsus$ Hunters collective. The hackers say they agreed to pay $25,000 and claim they briefly obtained SSO authentication cookies, but CrowdStrike reports no breach of its systems or customer data. The incident is now with law enforcement and highlights the impact of insider risks faced by organisations.
A Third of Workers Risk Cyber Security Breach by Using Work Devices for Personal Use
A survey of 1,000 Irish office workers finds 31% use work devices for personal tasks, with 32% clicking suspicious links and 22% accessing sensitive documents over public Wi-Fi. High risk behaviour includes 26% entering company data into AI tools, 33% using unauthorised tools and 19% sharing work passwords. Despite this, 73% feel confident spotting cyber threats and 54% in their password security, although 23% of organisations suffered a cyber security breach in the past year and 32% of workers do not receive regular training.
Source: https://businessplus.ie/news/cyber-security-work-devices-personal-use/
Shadow AI Security Breaches Will Hit 40% of All Companies by 2030, Warns Gartner
Gartner warns that 40% of organisations could suffer security breaches through shadow AI by 2030. Staff routinely paste documents or data into unapproved AI tools, risking exposure of customer records, salary information, source code and strategic plans. Surveys cited include one where 90% of security leaders admit using unapproved AI tools and 71% of UK employees do the same. Gartner advises clear AI policies, audits for unsanctioned usage and provision of approved tools with training.
Source: https://www.fortra.com/blog/shadow-ai-security-breaches-will-hit-40-companies-2030-warns-gartner
New (ISC)2 Report Finds That Vendor Security Gaps Threaten Critical Infrastructure and Supply Chains
An (ISC)2 study finds many organisations are worried about supplier risk yet are slow to manage it. Respondents report frequent security deficiencies in vendors, including weak identity controls, lack of compliance certifications and inadequate monitoring. Nearly a third experienced incidents linked to suppliers, yet many only review vendor security annually. The report urges continuous assessment, clearer contractual expectations and closer collaboration across procurement, legal and security teams.
Source: https://www.helpnetsecurity.com/2025/11/25/isc2-vendor-security-gaps-report/
A Fake Windows Update Screen Is Fooling Windows Users into Installing Malware
Researchers uncovered a new ClickFix campaign where full screen fake Windows Update or captcha pages trick users into pasting attacker supplied commands copied to their clipboard. The commands fetch PNG images that hide malware within pixel data, which a .NET Stego Loader decrypts and runs in memory. The attack includes software that runs 10,000 fake functions to hinder analysis by experts.
FBI: Cybercriminals Stole $262 Million by Impersonating Bank Support Teams Since January
The FBI warns that scammers posed as bank support staff in more than 5,100 complaints since January 2025, stealing around $262 million. Criminals convince victims to grant remote access, reveal credentials or approve transactions, then drain accounts or move funds into cryptocurrency. Tactics include spoofed phone numbers, fake support sites and search engine poisoning, prompting the FBI to urge customers to verify contact details and banks to harden customer authentication.
Compromised Credentials Responsible for 50% of Ransomware Attacks
Beazley Security’s Q3 2025 Threat Report shows ransomware surged in August and September, accounting for 26% and 18% of incidents. Akira, Qilin and INC Ransomware made up 65% of cases. The most common entry point was valid compromised credentials used to access VPNs, ahead of exploitation of internet facing systems. SonicWall vulnerabilities were heavily abused, with stolen configuration files expected to fuel future targeted attacks.
Source: https://natlawreview.com/article/compromised-credentials-responsible-50-ransomware-attacks
Russian and North Korean Hackers Form Alliances
Researchers say Russian group Gamaredon and North Korea’s Lazarus Group are collaborating by sharing infrastructure and tools, including command and control servers and the InvisibleFerret malware family. The partnership combines Russian espionage targeting with North Korean financially motivated operations, including past thefts of billions in crypto assets. Analysts warn this alignment could make both campaigns harder to attribute and disrupt.
Source: https://cybersecuritynews.com/russian-and-north-korean-hackers-form-alliances/
Alliances Between Ransomware Groups Tied to Recent Surge in Cybercrime
Data shows a 41% rise in ransomware attacks between September and October, with the ransomware group Qilin responsible for 29% of October incidents, followed by Sinobi and Akira. Ransomware groups such as LockBit 5.0, DragonForce and Qilin are forming alliances that share tools, infrastructure and reputations. North America suffered 62% of attacks, and more than 200 ransomware variants have been seen this year.
Governance, Risk and Compliance
UK cyber attacks will inevitably increase, HP boss warns
A third of workers risk cybersecurity breach by using work devices for personal use
Cybersecurity Is Now a Core Business Discipline - SecurityWeek
Ministers send small businesses cyber threat warning - UKTN
SolarWinds dismissed: what the SEC’s U-turn signals for cyber enforcement | A&O Shearman - JDSupra
Government publishes independent study revealing cost of cyber attacks to UK economy
Political instability is now the defining force behind global business risk | theHRD
Empathy key weapon in cyber fight
We must protect our society against tomorrow's cyber threats - GOV.UK
Root causes of security breaches remain elusive — jeopardizing resilience | CSO Online
Cyber demand grows following high-profile attacks - Insurance Post
UK Budget 2025: Reactions From Tech Leaders - TechRepublic
3 ways CISOs can win over their boards this budget season | CSO Online
The CISO’s greatest risk? Department leaders quitting | CSO Online
Selling to the CISO: An open letter to the cybersecurity industry | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Akira ransomware crew infected enterprise systems during M&A • The Register
Russia-linked crooks bought themselves a bank for Christmas • The Register
Get ready for 2026, the year of AI-aided ransomware • The Register
Compromised Credentials Responsible for 50% of Ransomware Attacks - Beazley
Alliances between ransomware groups tied to recent surge in cybercrime | CSO Online
Scattered Spider alleged members deny TfL charges
Ransomware Attacks Remaking Cyber as National Priority
Ransomware gangs seize a new hostage: your AWS S3 buckets | CSO Online
Scattered Lapsus$ Hunters stress testing Zendesk weak spots • The Register
Piecing Together the Puzzle: A Qilin Ransomware Investigation
Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim 'Korean Leaks' Data Heist
Hackers come for big British retailers | The Observer
UK car production plummets 24% in wake of JLR cyber attack | Autocar
Should we ban ransom payments to cyber attackers?
Ransomware Victims
Akira ransomware crew infected enterprise systems during M&A • The Register
Scattered Spider alleged members deny TfL charges
UK car production plummets 24% in wake of JLR cyber attack | Autocar
Crisis24 shuts down emergency notification system in wake of ransomware attack | CyberScoop
Canon Says Subsidiary Impacted by Oracle EBS Hack - SecurityWeek
Asahi Data Breach Impacts 2 Million Individuals - SecurityWeek
Scottish council still reeling from 2023 ransomware attack • The Register
Report warns councils after 2023 Western Isles cyber-attack | The Herald
NCSC called in as London councils grapple with cyber attacks | IT Pro
London Cyberattacks Confirmed — Security Experts Issue Multiple Warnings
Lessons From the European Airports Ransomware Attack | Lawfare
Phishing & Email Based Attacks
Email blind spots are back to bite security teams - Help Net Security
ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen
Advanced Security Isn't Stopping Old Phishing Tactics
Hackers Replace 'm' with 'rn' in Microsoft(.)com to Steal Users' Login Credentials
Microsoft cracks down on malicious meeting invites - Help Net Security
Phishing Breaks More Defenses Than Ever. Here’s the Fix
Other Social Engineering
ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen
A fake Windows Update screen is fooling Windows users into installing malware
FBI: Cybercriminals stole $262M by impersonating bank support teams
Microsoft cracks down on malicious meeting invites - Help Net Security
JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers
RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware
Fraud, Scams and Financial Crime
FBI: Cybercriminals stole $262M by impersonating bank support teams
Criminal networks industrialize payment fraud operations - Help Net Security
Scammers hacked her phone and stole thousands of pounds - how did they get her details? - BBC News
AI Arms Race: How to Stay Ahead of Generative AI-Powered Fraud | MSSP Alert
New legislation targets scammers that use AI to deceive | CyberScoop
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Did Myanmar’s Junta Demolish Scam Centers Just for Show? - The New York Times
Artificial Intelligence
Shadow AI Security Breaches will hit 40% of all Companies by 2030, Warns Gartner | Fortra
Get ready for 2026, the year of AI-aided ransomware • The Register
Underground AI models promise to be hackers ‘cyber pentesting waifu’ | CyberScoop
Vibe coding feels magical, but it can sink your business fast - here's how | ZDNET
'Dark LLMs' Aid Petty Criminals, Underwhelm Technically
How Malware Authors Incorporate LLMs to Evade Detection
Anthropic's new warning: If you train AI to cheat, it'll hack and sabotage too | ZDNET
Emerging threat from deepfakes leads to cybersecurity arms race | SC Media
Think your password is safe? AI could break it before you blink - BetaNews
AI Arms Race: How to Stay Ahead of Generative AI-Powered Fraud | MSSP Alert
New legislation targets scammers that use AI to deceive | CyberScoop
New research finds that Claude breaks bad if you teach it to cheat | CyberScoop
Four charged with plotting to sneak Nvidia chips into China • The Register
Google's AI is now snooping on your emails - here's how to opt out | ZDNET
CISOs Get Real About Hiring in the Age of AI
Prompt Injections Loom Large Over ChatGPT Atlas Browser
2FA/MFA
Germany urges default 2FA for webmail providers | Cybernews
Malware
A fake Windows Update screen is fooling Windows users into installing malware
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
How Malware Authors Incorporate LLMs to Evade Detection
JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers
Cybercriminals Exploit Browser Push Notifications to Deliver Malware - Infosecurity Magazine
BadAudio malware: How APT24 scaled its cyberespionage through supply chain attacks
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Operation Endgame disrupts Rhadamanthys information-stealing malware
DPRK’s FlexibleFerret Tightens macOS Grip
RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware
WSUS RCE Exploit Used to Deploy ShadowPad Backdoor
Bots/Botnets
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
Mobile
New CISA alert: encryption isn't what's failing on Signal and WhatsApp | TechSpot
CISA Warns of Active Spyware Campaigns Hijacking High-Value Signal and WhatsApp Users
Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications | CISA
Scammers hacked her phone and stole thousands of pounds - how did they get her details? - BBC News
Internet of Things – IoT
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
Aircraft cabin IoT leaves vendor and passenger data exposed - Help Net Security
Data Breaches/Leaks
The breaches everyone gets hit by (and how to stop them) - Help Net Security
JPMorgan, Citi, Morgan Stanley Client Data May Be Exposed by Vendor's Hack, NYT Reports
Gainsight Expands Impacted Customer List Following Salesforce Security Alert
OpenAI data may have been exposed after a cyberattack on analytics firm Mixpanel
Iberia discloses customer data leak after vendor security breach
Council had ‘gaps in cybersecurity’ before ransomware attack
Cox Enterprises discloses Oracle E-Business Suite data breach
183 Million Credentials Misreported as a Gmail Breach - Security Boulevard
Russian and North Korean hackers steal 2TB of data from South Korean banks - Cryptopolitan
Canon Says Subsidiary Impacted by Oracle EBS Hack - SecurityWeek
Asahi Data Breach Impacts 2 Million Individuals - SecurityWeek
Kensington and Chelsea Council cyber attack sees emergency plans initiated - BBC News
NCSC called in as London councils grapple with cyber attacks | IT Pro
US car parts dealer allegedly hit by massive breach | Cybernews
Organised Crime & Criminal Actors
Criminal networks industrialize payment fraud operations - Help Net Security
Ministers send small businesses cyber threat warning - UKTN
Government publishes independent study revealing cost of cyber attacks to UK economy
'Dark LLMs' Aid Petty Criminals, Underwhelm Technically
Alice Guo: Philippines jails 'Chinese spy mayor' for life - BBC News
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Did Myanmar’s Junta Demolish Scam Centers Just for Show? - The New York Times
Insider Risk and Insider Threats
A third of workers risk cybersecurity breach by using work devices for personal use
Cybersecurity giant CrowdStrike fires insider working with hackers - Cryptopolitan
Human risk: don’t blame the victim, fix the system | TechRadar
Why legal firms must confront insider cyber threats - Tech Monitor
Empathy key weapon in cyber fight
Supply Chain and Third Parties
JPMorgan, Citi, Morgan Stanley Client Data May Be Exposed by Vendor's Hack, NYT Reports
Gainsight Expands Impacted Customer List Following Salesforce Security Alert
Iberia discloses customer data leak after vendor security breach
BadAudio malware: How APT24 scaled its cyberespionage through supply chain attacks
Supply chain sprawl is rewriting security priorities - Help Net Security
Cox Enterprises discloses Oracle E-Business Suite data breach
Google security experts say Gainsight hacks may have left hundreds of companies affected | TechRadar
Canon Says Subsidiary Impacted by Oracle EBS Hack - SecurityWeek
Software Supply Chain
UK Report Proposes Liability For Software Provider Insecurity - Infosecurity Magazine
Cloud/SaaS
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
ToddyCat's New Hacking Tools Steal Outlook Emails and Microsoft 365 Access Tokens
MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants
Ransomware gangs seize a new hostage: your AWS S3 buckets | CSO Online
How has cloud flipped the regular security narrative? – Computerworld
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
Outages
Internet failure highlighted connected risk – Russell
Encryption
New CISA alert: encryption isn't what's failing on Signal and WhatsApp | TechSpot
Cheap Device Bypasses AMD, Intel Memory Encryption
Quantum encryption is pushing satellite hardware to its limits - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Compromised Credentials Responsible for 50% of Ransomware Attacks - Beazley
DPRK’s FlexibleFerret Tightens macOS Grip
Hackers Replace 'm' with 'rn' in Microsoft(.)com to Steal Users' Login Credentials
Social data puts user passwords at risk in unexpected ways - Help Net Security
Think your password is safe? AI could break it before you blink - BetaNews
183 Million Credentials Misreported as a Gmail Breach - Security Boulevard
Social Media
Social data puts user passwords at risk in unexpected ways - Help Net Security
Influencers in the crosshairs: How cybercriminals are targeting content creators
Regulations, Fines and Legislation
Should we ban ransom payments to cyber attackers?
Mounting Cyber-Threats Prompt Calls For Economic Security Bill - Infosecurity Magazine
Key provisions of the UK Cyber Resilience Bill Revealed - Infosecurity Magazine
SolarWinds dismissed: what the SEC’s U-turn signals for cyber enforcement | A&O Shearman - JDSupra
The Internet Is on Fire and the FCC Just Walked Away With the Extinguisher
Rights groups accuse ICO of ‘collapse in enforcement activity’
UK data regulator under pressure after failing to regulate public sector effectively - Neowin
NIS2 Directive Explained: Part 2 – Management Bodies Rules | DLA Piper - JDSupra
New legislation targets scammers that use AI to deceive | CyberScoop
Four charged with plotting to sneak Nvidia chips into China • The Register
UK Report Proposes Liability For Software Provider Insecurity - Infosecurity Magazine
Switching to Offense: US Makes Cyber Strategy Changes
Powers to protect us from cyber attacks ‘go too far’
Mobile industry warns patchwork regs are driving up costs • The Register
New York Hospital Cyber Rules to 'Raise the Bar' Nationwide
Models, Frameworks and Standards
Key provisions of the UK Cyber Resilience Bill Revealed - Infosecurity Magazine
NIS2 Directive Explained: Part 2 – Management Bodies Rules | DLA Piper - JDSupra
Data Protection
Rights groups accuse ICO of ‘collapse in enforcement activity’
UK data regulator under pressure after failing to regulate public sector effectively - Neowin
Careers, Working in Cyber and Information Security
Invisible battles: How cybersecurity work erodes mental health | CSO Online
CISOs Get Real About Hiring in the Age of AI
The CISO’s greatest risk? Department leaders quitting | CSO Online
Law Enforcement Action and Take Downs
Operation Endgame disrupts Rhadamanthys information-stealing malware
'Scattered Spider' teens plead not guilty to UK transport hack
Russian Suspected of Cyberattacks on Polish and EU Companies Detained in Krakow - Militarnyi
Alice Guo: Philippines jails 'Chinese spy mayor' for life - BBC News
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Did Myanmar’s Junta Demolish Scam Centers Just for Show? - The New York Times
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
BadAudio malware: How APT24 scaled its cyberespionage through supply chain attacks
Polish minister warns of ongoing 'cyberwar' with Russia - TRT World
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
With Friends Like These: China Spies on Russian IT Orgs
As Space Becomes Warfare Domain, Cyber Is on the Frontlines
Security is not only military—it is societal. Something worth learning from the Scandinavians
Nation State Actors
Political instability is now the defining force behind global business risk | theHRD
Switching to Offense: US Makes Cyber Strategy Changes
China
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
With Friends Like These: China Spies on Russian IT Orgs
Four charged with plotting to sneak Nvidia chips into China • The Register
Alice Guo: Philippines jails 'Chinese spy mayor' for life - BBC News
Russia
Polish minister warns of ongoing 'cyberwar' with Russia - TRT World
Russia-linked crooks bought themselves a bank for Christmas • The Register
Russian and North Korean Hackers Form Alliances to Attack Organizations Worldwide
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
With Friends Like These: China Spies on Russian IT Orgs
Russian Suspected of Cyberattacks on Polish and EU Companies Detained in Krakow - Militarnyi
Russian and North Korean hackers steal 2TB of data from South Korean banks - Cryptopolitan
Iran
Iranian APT hacks helped direct missile strikes in Israel and the Red Sea | CSO Online
North Korea
Russian and North Korean Hackers Form Alliances to Attack Organizations Worldwide
DPRK’s FlexibleFerret Tightens macOS Grip
Russian and North Korean hackers steal 2TB of data from South Korean banks - Cryptopolitan
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Political instability is now the defining force behind global business risk | theHRD
Security is not only military—it is societal. Something worth learning from the Scandinavians
Tools and Controls
Advanced Security Isn't Stopping Old Phishing Tactics
Root causes of security breaches remain elusive — jeopardizing resilience | CSO Online
MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants
Vibe coding feels magical, but it can sink your business fast - here's how | ZDNET
Recognizing and responding to cyber threats: What differentiates NDR, EDR and XDR | CSO Online
3 ways CISOs can win over their boards this budget season | CSO Online
Security teams want automation but 96 percent face problems implementing it - BetaNews
Other News
Vehicle Hackers Continue Outpacing Cybersecurity Efforts, Expert Says
This tiny Windows shortcut file is a bigger security threat than you think
Ex-CISA officials, CISOs aim to stop the spread of hacklore • The Register
This campaign aims to tackle persistent security myths in favor of better advice | CyberScoop
We must protect our society against tomorrow's cyber threats - GOV.UK
Legacy web forms are the weakest link in government data security | CyberScoop
Vulnerability Management
Around 500 million PCs are holding off upgrading to Windows 11, says Dell | The Verge
Fragmented tooling slows vulnerability management - Help Net Security
What happens when vulnerability scores fall apart? - Help Net Security
Vulnerabilities
SonicWall Patches High-Severity Flaws in Firewalls, Email Security Appliance - SecurityWeek
Akira's SonicWall Hacks Are Taking Down Large Enterprises
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Critical Vulnerability in Azure Bastion Let Attackers Bypass Authentication and Escalate privileges
Critical Oracle Identity Manager Flaw Under Attack
WSUS RCE Exploit Used to Deploy ShadowPad Backdoor
Prompt Injections Loom Large Over ChatGPT Atlas Browser
ASUS warns of new critical auth bypass flaw in AiCloud routers
CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability
Microsoft: Out-of-band update fixes Windows 11 hotpatch install loop
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 21 November 2025
Black Arrow Cyber Threat Intelligence Briefing 21 November 2025:
-The Trojan Prompt: How GenAI Is Turning Staff Into Unwitting Insider Threats
-Copy And Paste Cyber Security Warning — 99% Of Enterprises Now At Risk
-Google: Threat Groups Will Accelerate Their Use of AI in 2026
-“We’ve Seen a 30% Increase in Successful Email Scams in the Last Two Years”
-“We Are Moments Before the First Real Cyberwar, One in Which Not a Single Shot Is Fired”
-Our Industries Are Vulnerable to Cyber Attacks: Boardrooms Must Prioritize Resilience, Not Reaction
-Overconfidence Is the New Cyber Risk: Immersive’s 2025 Cyber Workforce Benchmark Report Exposes a Global Readiness Illusion
-The Hidden Cost of a Hack: Unpacking the Ripple Effect of Cybercrime
-Half of Ransomware Access Due to Hijacked VPN Credentials
-Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites
-UK Targets Russian Cyber Gang as £14.7 Billion Attacks Hit British Economy
-Cyber-enabled Kinetic Targeting: Iran-linked Actor Uses Cyber Operations to Support Physical Attacks
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week, we have reviewed several articles in the specialist and general media about the risks presented by AI, in particular generative AI. These include employees pasting sensitive information into public tools, and attackers exploiting the functionality of GenAI such as using Claude to almost completely carry out a cyber espionage operation against organisations. Our review also highlights that the more traditional attack vectors remain a risk for organisations, including hijacked VPNs, weak password controls, and phishing.
Our message to business leaders is clear and unchanged, and supported by various sources included in our review this week: Boards must ensure they have a realistic assessment of their readiness to deal with a cyber attack. It is particularly important that business leaders should be part of the readiness and should not consider the response to be IT focused. This requires an upskilled leadership team to command and govern their cyber security; contact us for details of how we support organisations to achieve this in a proportionate way.
Top Cyber Stories of the Last Week
The Trojan Prompt: How GenAI Is Turning Staff into Unwitting Insider Threats
Two evolving risks are emerging relating to generative AI. The first, a “Trojan prompt”, is where staff paste sensitive documents, credentials or API keys into public GenAI tools which often fall outside monitoring by traditional cyber security data loss prevention and monitoring controls. The second is the “Imprompter” attack, where hidden instructions in prompts harvest personal data with close to an 80% success rate. A robust response to these combines clear GenAI governance, user education and hardware level zero trust on endpoints that inspects when data is accessed on the device’s drive itself.
Copy And Paste Cyber Security Warning — 99% Of Enterprises Now at Risk
LayerX’s Browser Security Report finds that sensitive data now often leaves enterprises through copy and paste rather than file uploads. Findings show that 77% of employees paste data into AI tools and 46% into file storage, frequently outside IT control. Browser extensions amplify the risks, with 99% of enterprise users having at least one installed, more than half holding high or critical permissions. 26% are installed outside normal channels (sideloaded), creating major blind spots for security teams.
Google: Threat Groups Will Accelerate Their Use of AI in 2026
Anthropic’s research shows China linked attackers using the generative AI engine Claude to carry out around 80% to 90% of a cyber espionage operation against about 30 organisations, with humans stepping in only at key decision points. Meanwhile, Google’s Cybersecurity Forecast 2026 expects threat groups to adopt AI across reconnaissance, exploitation and malware development, while AI enabled tools can also reshape how cyber security teams defend the organisation.
Source: https://www.msspalert.com/news/google-threat-groups-will-accelerate-their-use-of-ai-in-2026
“We’ve Seen a 30% Increase in Successful Email Scams in the Last Two Years”
Data from At Bay, which insures about 40,000 businesses, shows a 30% increase in successful email scams over two years as attackers use AI to craft convincing, personalised messages. Traditional email security struggles with this variety and speed. Organisations are urged to move towards context aware detection, scrutinise how AI agents are integrated into systems and recognise the new attack surfaces created by rapid AI adoption.
Source: https://www.calcalistech.com/ctechnews/article/lsncr0rtd
“We Are Moments Before the First Real Cyberwar, One in Which Not a Single Shot Is Fired”
The Director General of Israel’s National Cyber Directorate describes three stages of AI and cyber convergence: using AI for cyber defence, protecting AI systems themselves and a future AI versus AI phase where autonomous agents conduct both attacks and defence. Israel is cited as one of the most targeted countries globally. AI driven campaigns are expected to be capable of digitally besieging states, even as constant pressure will force defences to improve.
Source: https://www.calcalistech.com/ctechnews/article/askx8c3bj
Our Industries Are Vulnerable to Cyber Attacks: Boardrooms Must Prioritize Resilience, Not Reaction
A new report by Accenture indicates the challenge faced by organisations defending against AI driven threats. It finds that 88% of UK firms lack the maturity needed as AI accelerates ransomware, deepfakes and data theft. Cyber security is presented as a people and reputation issue as much as a technical one. Boards should embed security into strategy, build cross functional crisis preparations and design business continuity for critical services.
Source: https://www.infosecurity-magazine.com/opinions/boardrooms-must-prioritize/
Overconfidence Is the New Cyber Risk: Immersive’s 2025 Cyber Workforce Benchmark Report Exposes a Global Readiness Illusion
Immersive’s 2025 Cyber Workforce Benchmark Report finds that 94% of organisations feel ready for a major incident, yet in the simulated attacks only 22% of the decisions made were appropriate and average containment times are around 29 hours. Only 41% of organisations involve non technical teams in simulations, leaving a significant readiness gap.
The Hidden Cost of a Hack: Unpacking the Ripple Effect of Cybercrime
Beazley’s risk and resilience research with 3,500 leaders shows 29% of executives now rank cyber as their greatest threat, up from 26% in 2024. The findings highlight that business leaders may not fully appreciate the full lifecycle of incidents, including legal actions, regulatory scrutiny and long term reputational harm. Boards should plan for extended disruption and financial ripple effects, not only initial recovery.
Half of Ransomware Access Due to Hijacked VPN Credentials
Beazley Security reports that ransomware incidents increased in Q3 2025, with Akira, Qilin and INC responsible for about 65% of cases and leak posts rising 11% quarter on quarter. Valid VPN credentials provided initial access in 48% of breaches, up from 38% in Q2, while external service exploits accounted for 23%. Infostealers and credential stuffing attacks against SonicWall SSL VPNs feature heavily, reinforcing the need for phishing resistant MFA, conditional access and continuous vulnerability management.
Source: https://www.infosecurity-magazine.com/news/half-ransomware-access-hijacked/
Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites
Socura and Flare’s “FTSE 100 for Sale” report identifies about 460,000 compromised credentials associated with FTSE 100 staff across cybercrime sites. More than 70,000 credentials relate to financial services, and 28,000 appear in infostealer logs, roughly 280 per company. Weak password practices such as “password” and obvious reuse of passwords persist, underscoring the need for strong policies, phishing resistant MFA, conditional access and proactive leak monitoring.
Source: https://www.infosecurity-magazine.com/news/half-million-stolen-ftse-100/
UK Targets Russian Cyber Gang as £14.7 Billion Attacks Hit British Economy
Sanctions against a cyber crime infrastructure / hosting provider called Media Land and its leader Alexander Volosovik target a Russian hosting provider accused of supporting ransomware, phishing and other criminal campaigns against UK organisations. Cyber attacks are estimated to have cost UK businesses about £14.7 billion in 2024, roughly 0.5% of GDP. The move builds on earlier actions against groups such as Evil Corp and LockBit, aiming to disrupt broader Russia based cyber crime ecosystems.
Source: https://www.easterneye.biz/uk-cybercrime-russian-attack-british-economy/
Cyber-enabled Kinetic Targeting: Iran-linked Actor Uses Cyber Operations to Support Physical Attacks
Amazon’s threat intelligence research describes how Iran-aligned actors integrate cyber operations with physical strikes in what it calls ‘cyber enabled kinetic targeting’. The attack group called Imperial Kitten reportedly accessed a ship’s tracking platform and onboard CCTV before an attempted attack on the same vessel by a Houthi missile. Another group, MuddyWater, is linked to compromised cameras in Israel that were then used to support missile strikes, showing how hacked sensors and live data can guide battlefield decisions.
Governance, Risk and Compliance
Organizations overconfident in dealing with cybersecurity incidents - BetaNews
Holyrood | Everyone’s a target: The importance of cybersecurity in a fast changing world
The growing risks presented by cyber security and data breaches – The Irish News
The hidden cost of a hack: Unpacking the ripple effect of cybercrime | Insurance Business America
Resilience At Risk: Talent and Governance in the Age of AI - Infosecurity Magazine
The realities of CISO burnout and exhaustion | CyberScoop
SEC to Drop Controversial SolarWinds Cyberattack Lawsuit
Unpreparedness for risks a worry for CEOs: Kroll Chief Jacob Silverman - The Economic Times
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns
Half of Ransomware Access Due to Hijacked VPN Credentials - Infosecurity Magazine
Russian money launderers bought a bank to disguise ransomware profit | Computer Weekly
The Akira Playbook: How Ransomware Groups Are Weaponizing MFA Fatigue - Security Boulevard
UK's New Cybersecurity Bill Takes Aim at Ransomware Gangs and State-Backed Hackers | Fortra
UK cyber ransom ban risks collapse of essential services
The ransomware payment debate: what it means for organizations | TechRadar
'The Gentlemen' Ransomware Group with Dual-Extortion Strategy Encrypts and Exfiltrates Data
Akira ransomware expands to Nutanix AHV, raising stakes for enterprise security | CSO Online
Cat’s Got Your Files: Lynx Ransomware – The DFIR Report
Ransomware Victims
Oracle Allegedly Breached by Clop Ransomware via E-Business Suite 0-Day Hack
Checkout.com snubs hackers after data breach, to donate ransom instead
Jaguar Land Rover confirms major disruption and £196M cost from September cyberattack
Logitech confirms data breach after Clop extortion attack
Hackers Allegedly Claim Leak of LG Source Code, SMTP, and Hardcoded Credentials
The Washington Post reveals thousands impacted via Oracle-based hack | Cybernews
Everest Ransomware Group Allegedly Exposes 343 GB of Sensitive Data in Major Under Armour Breach
Cornerstone staffing ransomware attack leaks 120,000 resumes, claims Qilin gang | Cybernews
Hacker claims to steal 2.3TB data from Italian rail group, Almaviva
Phishing & Email Based Attacks
Beware! How AI is writing phishing emails that look real | PCWorld
AI Is Supercharging Phishing: Here’s How to Fight Back - SecurityWeek
Beware of Phishing Emails as Spam Filter Alerts Steal Your Email Logins in a Blink
Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real | Malwarebytes
Sneaky2FA PhaaS kit now uses redteamers' Browser-in-the-Browser attack
“We've seen a 30% increase in successful email scams in the last two years” | Ctech
The Tycoon 2FA Phishing Platform and the Collapse of Legacy MFA
Other Social Engineering
Copy And Paste Cybersecurity Warning — 99% Of Enterprises Now At Risk
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
The long conversations that reveal how scammers work - Help Net Security
The Akira Playbook: How Ransomware Groups Are Weaponizing MFA Fatigue - Security Boulevard
Five plead guilty to helping North Koreans infiltrate US firms
Five admit helping North Korea evade sanctions through IT worker schemes
DoJ nets five guilty pleas in Pyongyang’s IT-worker hustle • The Register
US: Five Plead Guilty in North Korean IT Worker Fraud Scheme - Infosecurity Magazine
Almost five-fold increase in reports of online investment ad scams
Convenience culture is breaking personal security - Help Net Security
Scammers sent 166,000 scam texts to NY residents this week in major hack | Mashable
Fraud, Scams and Financial Crime
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
The long conversations that reveal how scammers work - Help Net Security
Don't get ghost tapped: 5 ways to block thieves from scanning your wallet | ZDNET
Almost five-fold increase in reports of online investment ad scams
Convenience culture is breaking personal security - Help Net Security
“We've seen a 30% increase in successful email scams in the last two years” | Ctech
BitQueen jailed as chancellor eyes up her seized £5bn wealth
AI scams surge: how consumers and businesses can stay safe | TechRadar
AI powering transnational crime as Asian gangs move into Pacific - Nikkei Asia
Online safety ‘getting worse’, warns former UK cyber security agency boss | The Standard
Payroll Pirates - Network of Criminal Groups Hijacking Payroll Systems
GenAI and Deepfakes Drive Digital Forgeries and Biometric Fraud - Infosecurity Magazine
UNC2891 Money Mule Network Reveals Full Scope of ATM Fraud Operation - Infosecurity Magazine
Scammers sent 166,000 scam texts to NY residents this week in major hack | Mashable
US announces new strike force targeting Chinese crypto scammers
Artificial Intelligence
Gartner: 40% of Firms to Be Hit By Shadow AI Security Incidents - Infosecurity Magazine
Beware! How AI is writing phishing emails that look real | PCWorld
AI Is Supercharging Phishing: Here’s How to Fight Back - SecurityWeek
Chinese spies used Claude to break into critical orgs • The Register
China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work | CyberScoop
AI chatbots can now execute cyberattacks almost on their own | Vox
What the Anthropic Report on AI Espionage Means for Security Leaders - Intezer
Anthropic Has Some Key Advice for Businesses in the Aftermath of a Massive AI Cyberattack
The Trojan Prompt: How GenAI is Turning Staff into Unwitting Insider Threats - Security Boulevard
Could years of AI conversations be your biggest security blind spot? | IT Pro
How attackers use patience to push past AI guardrails - Help Net Security
Dark LLMs Are Targeting MSPs’ Customers | MSSP Alert
AI Is Supercharging Disinformation Warfare | Foreign Affairs
Google: Threat Groups Will Accelerate Their Use of AI in 2026 | MSSP Alert
“We are moments before the first real cyberwar, one in which not a single shot is fired | Ctech
Convenience culture is breaking personal security - Help Net Security
AI powering transnational crime as Asian gangs move into Pacific - Nikkei Asia
Shadow AI: the next frontier of unseen risk | TechRadar
Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
Microsoft Warns Windows 11 AI Can Install Malware
GenAI and Deepfakes Drive Digital Forgeries and Biometric Fraud - Infosecurity Magazine
Foreign Spies Deploying AI in Cyberattacks | Newsmax.com
Agentic AI puts defenders on a tighter timeline to adapt - Help Net Security
How AI can magnify your tech debt - and 4 ways to avoid that trap | ZDNET
Don't ignore the security risks of agentic AI - SiliconANGLE
Cursor Issue Paves Way for Credential-Stealing Attacks
2FA/MFA
The Akira Playbook: How Ransomware Groups Are Weaponizing MFA Fatigue - Security Boulevard
Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real | Malwarebytes
The Tycoon 2FA Phishing Platform and the Collapse of Legacy MFA
Malware
Microsoft Warns Windows 11 AI Can Install Malware
SilentButDeadly - Network Communication Blocker Tool That Neutralizes EDR/AV
North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels
Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT
New npm Malware Campaign Redirects Victims to Crypto Sites - Infosecurity Magazine
Google exposes BadAudio malware used in APT24 espionage campaigns
Why ‘AI-Powered’ Cyber-Attacks Are Not a Serious Threat …Yet - Infosecurity Magazine
LLM-generated malware improving, but not operational (yet) • The Register
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
Google Finds New Malware Backdoors Linked to Iran
Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks
Bots/Botnets
Largest Azure DDoS Attack Powered by Aisuru Botnet - SecurityWeek
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
Mobile
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
Multi-threat Android malware Sturnus steals Signal, WhatsApp messages
Budget Samsung phones shipped with unremovable spyware, say researchers | Malwarebytes
WhatsApp easily exposed 3.5 billion people's phone numbers - GSMArena.com news
CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat
WhatsApp 'Eternidade' Trojan Worms Through Brazil
NSO Group argues WhatsApp injunction threatens existence, future U.S. government work | CyberScoop
Denial of Service/DoS/DDoS
Microsoft Mitigates Record 15.72 Tbps DDoS Attack Driven by AISURU Botnet
Internet of Things – IoT
Cybersecurity risks inside the powertrain: why EVs need defence at the motor level - Just Auto
Data Breaches/Leaks
Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites - Infosecurity Magazine
Schools share blame for PowerSchool mega-hack, say watchdogs • The Register
MoD ‘knew using Excel was risky before Afghan data leak’
Hackers Allegedly Claim Leak of LG Source Code, SMTP, and Hardcoded Credentials
The Washington Post reveals thousands impacted via Oracle-based hack | Cybernews
Everest Ransomware Group Allegedly Exposes 343 GB of Sensitive Data in Major Under Armour Breach
WhatsApp easily exposed 3.5 billion people's phone numbers - GSMArena.com news
Major Urssaf cyberattack in France affects 1.2 million Pajemploi users
Eurofiber admits crooks swiped data from French unit • The Register
Pentagon and soldiers let too many secrets slip on socials • The Register
Organised Crime & Criminal Actors
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
AI powering transnational crime as Asian gangs move into Pacific - Nikkei Asia
Online safety ‘getting worse’, warns former UK cyber security agency boss | The Standard
Payroll Pirates - Network of Criminal Groups Hijacking Payroll Systems
British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News
Dutch police takes down bulletproof hosting hub linked to 80+ cybercrime cases
CISA Issues New Guidance on Bulletproof Hosting Threat - Infosecurity Magazine
UNC2891 Money Mule Network Reveals Full Scope of ATM Fraud Operation - Infosecurity Magazine
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island - SecurityWeek
South Korean man sentenced to prison for sending $16K to North Korean hacker | NK News
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
BitQueen jailed as chancellor eyes up her seized £5bn wealth
Europol Operation Disrupts $55m in Cryptocurrency for Piracy - Infosecurity Magazine
Wind farm worker sentenced after turning turbines into a secret crypto mine
New npm Malware Campaign Redirects Victims to Crypto Sites - Infosecurity Magazine
Security researcher calls BS on Coinbase breach timeline • The Register
US announces new strike force targeting Chinese crypto scammers
Insider Risk and Insider Threats
The Trojan Prompt: How GenAI is Turning Staff into Unwitting Insider Threats - Security Boulevard
Rogue techie pleads guilty in $862K employer attack • The Register
Wind farm worker sentenced after turning turbines into a secret crypto mine
The Password Was ‘Password’: Why Humans Keep Breaking the Internet
Insurance
What insurers really look at in your identity controls - Help Net Security
Supply Chain and Third Parties
Dark LLMs Are Targeting MSPs’ Customers | MSSP Alert
Cloud/SaaS
Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses
Cloudflare hit by outage affecting Global Network services
And so this is how a tiny Cloudflare update broke huge chunks of the internet | TechSpot
Outages
Cloudflare hit by outage affecting Global Network services
And so this is how a tiny Cloudflare update broke huge chunks of the internet | TechSpot
The internet isn't free: Shutdowns, surveillance and algorithmic risks - Help Net Security
Identity and Access Management
What insurers really look at in your identity controls - Help Net Security
Encryption
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
Dozens of groups call for governments to protect encryption | CyberScoop
Linux and Open Source
5 reasons Kaspersky releasing a Linux antivirus product worries me
Passwords, Credential Stuffing & Brute Force Attacks
Half of Ransomware Access Due to Hijacked VPN Credentials - Infosecurity Magazine
Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites - Infosecurity Magazine
The Password Was ‘Password’: Why Humans Keep Breaking the Internet
The world's most popular passwords are pretty unsurprising - surely we can do better? | TechRadar
Zoomers are officially worse at passwords than 80-year-olds • The Register
Cursor Issue Paves Way for Credential-Stealing Attacks
Social Media
British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News
Convenience culture is breaking personal security - Help Net Security
Pentagon and soldiers let too many secrets slip on socials • The Register
Regulations, Fines and Legislation
UK's New Cybersecurity Bill Takes Aim at Ransomware Gangs and State-Backed Hackers | Fortra
UK cyber ransom ban risks collapse of essential services
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
Dozens of groups call for governments to protect encryption | CyberScoop
SEC to Drop Controversial SolarWinds Cyberattack Lawsuit
Cyber Operations on Domestic Networks Redux | Lawfare
CISA 2015 Receives Extension - Infosecurity Magazine
ENISA Is Now a CVE Program Root - DataBreachToday
Models, Frameworks and Standards
The UK’s Proposed Cyber Security and Resilience Bill | Hogan Lovells - JDSupra
Careers, Working in Cyber and Information Security
Resilience At Risk: Talent and Governance in the Age of AI - Infosecurity Magazine
Learning Sales Skills Make Security Pros More Effective
The retail sector needs a cybersecurity talent incubator | CyberScoop
Law Enforcement Action and Take Downs
Rogue techie pleads guilty in $862K employer attack • The Register
British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News
Wind farm worker sentenced after turning turbines into a secret crypto mine
BitQueen jailed as chancellor eyes up her seized £5bn wealth
Europol Operation Disrupts $55m in Cryptocurrency for Piracy - Infosecurity Magazine
Dutch police takes down bulletproof hosting hub linked to 80+ cybercrime cases
UNC2891 Money Mule Network Reveals Full Scope of ATM Fraud Operation - Infosecurity Magazine
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island - SecurityWeek
US announces new strike force targeting Chinese crypto scammers
South Korean man sentenced to prison for sending $16K to North Korean hacker | NK News
What are the potential punishments and risks of owning a 'dodgy firestick'? | The Standard
Europol Leads Takedown of Thousands of Extremist Gaming Links - Infosecurity Magazine
Misinformation, Disinformation and Propaganda
AI Is Supercharging Disinformation Warfare | Foreign Affairs
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
“We are moments before the first real cyberwar, one in which not a single shot is fired | Ctech
Russia preparing for war against NATO says top General
U.S. Space Force launches new triad of jammers to disrupt Chinese and Russian satellites
UK will not tolerate Chinese spying, minister says after MI5 alert - BBC News
MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn - SecurityWeek
Countries use cyber targeting to plan strikes: Amazon CSO • The Register
Google exposes BadAudio malware used in APT24 espionage campaigns
Iranian Hackers Launch 'SpearSpecter' Spy Operation on Defense & Government Targets
Nation State Actors
“We are moments before the first real cyberwar, one in which not a single shot is fired | Ctech
Countries use cyber targeting to plan strikes: Amazon CSO • The Register
UK's New Cybersecurity Bill Takes Aim at Ransomware Gangs and State-Backed Hackers | Fortra
Foreign Spies Deploying AI in Cyberattacks | Newsmax.com
Palo Alto CEO tips nations to weaponize quantum by 2029 • The Register
Take fight to the enemy, US cyber boss says • The Register
China
Chinese spies used Claude to break into critical orgs • The Register
China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work | CyberScoop
What the Anthropic Report on AI Espionage Means for Security Leaders - Intezer
AI doesn't just assist cyberattacks anymore - now it can carry them out | ZDNET
Chinese Nation-State Groups Hijacking Software Updates
UK will not tolerate Chinese spying, minister says after MI5 alert - BBC News
MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn - SecurityWeek
Foreign Spies Deploying AI in Cyberattacks | Newsmax.com
U.S. Space Force launches new triad of jammers to disrupt Chinese and Russian satellites
Google exposes BadAudio malware used in APT24 espionage campaigns
Germany lines up new powers to fend off Chinese tech – POLITICO
New WrtHug campaign hijacks thousands of end-of-life ASUS routers
TP-Link accuses rival Netgear of 'smear campaign' • The Register
US announces new strike force targeting Chinese crypto scammers
Russia
Russia preparing for war against NATO says top General
Countries use cyber targeting to plan strikes: Amazon CSO • The Register
UK, US and Australia Sanction Russian Bulletproof Hoster Media Land - Infosecurity Magazine
UK hits Russian cyber gang as £14.7 billion attacks damage economy | EasternEye
U.S. Space Force launches new triad of jammers to disrupt Chinese and Russian satellites
Russian money launderers bought a bank to disguise ransomware profit | Computer Weekly
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island - SecurityWeek
Russia keeps cutting mobile internet, and people are getting fed up - The Washington Post
Iran
Cyber-enabled kinetic targeting: Iran-linked actor uses cyber operations to support physical attacks
Iranian Hackers Launch 'SpearSpecter' Spy Operation on Defense & Government Targets
Iran's Cyber Objectives: What Do They Want?
Google Finds New Malware Backdoors Linked to Iran
Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks
North Korea
US: Five Plead Guilty in North Korean IT Worker Fraud Scheme - Infosecurity Magazine
North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels
South Korean man sentenced to prison for sending $16K to North Korean hacker | NK News
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Europol Leads Takedown of Thousands of Extremist Gaming Links - Infosecurity Magazine
Tools and Controls
Half of Ransomware Access Due to Hijacked VPN Credentials - Infosecurity Magazine
Palo Alto kit sees massive surge in malicious activity • The Register
Agentic AI puts defenders on a tighter timeline to adapt - Help Net Security
Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage | CyberScoop
5 reasons Kaspersky releasing a Linux antivirus product worries me
SilentButDeadly - Network Communication Blocker Tool That Neutralizes EDR/AV
Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT
Vibe coding to vibe hacking: securing software in the AI era | TechRadar
Resilience At Risk: Talent and Governance in the Age of AI - Infosecurity Magazine
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
What insurers really look at in your identity controls - Help Net Security
Cursor Issue Paves Way for Credential-Stealing Attacks
CISO pay is on the rise, even as security budgets tighten | CIO Dive
Other News
Palo Alto kit sees massive surge in malicious activity • The Register
Schools share blame for PowerSchool mega-hack, say watchdogs • The Register
The internet isn't free: Shutdowns, surveillance and algorithmic risks - Help Net Security
Initial Access Brokers (IAB) in 2025 - From Dark Web Listings to Supply Chain Ransomware Events
Hospitals in the cyber crosshairs - POLITICO
Cyber Operations on Domestic Networks Redux | Lawfare
Black Friday as retailers face cyber surge
TV streaming piracy service with 26M yearly visits shut down
Vulnerability Management
Chinese Nation-State Groups Hijacking Software Updates
Threat group reroutes software updates through hacked network gear - Help Net Security
Can a Global, Decentralized System Save CVE Data?
ENISA Is Now a CVE Program Root - DataBreachToday
Cyber Agency Warns of Government Exploits - DevX
Vulnerabilities
Fortinet finally cops to critical bug under active exploit • The Register
Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week - SecurityWeek
New SonicWall SonicOS flaw allows hackers to crash firewalls
Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage | CyberScoop
Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
7-Zip RCE flaw (CVE-2025-11001) actively exploited in attacks in the wild
SolarWinds Patches Three Critical Serv-U Vulnerabilities - SecurityWeek
ASUS warns of critical auth bypass flaw in DSL series routers
Google fixed the seventh Chrome zero-day in 2025
W3 Total Cache WordPress plugin vulnerable to PHP command injection
CVE-2025-50165: Critical Flaw in Windows Graphics Component - Security Boulevard
New WrtHug campaign hijacks thousands of end-of-life ASUS routers
ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts
Millions of sites at risk from Imunify360 critical flaw exploit
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
D-Link warns of new RCE flaws in end-of-life DIR-878 routers
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 14 November 2025
Black Arrow Cyber Threat Intelligence Briefing 14 November 2025:
-Microsoft Teams’ New “Chat With Anyone” Feature Exposes Users To Phishing and Malware Attacks
-Chinese Spies Told Claude To Break Into About 30 Critical Orgs. Some Attacks Succeeded
-5 Reasons Why Attackers Are Phishing Over LinkedIn
-Cyber Insurers Paid Out Over Twice as Much for UK Ransomware Attacks Last Year
-Large Organisations Aren’t Paying Ransomware Threats Anymore: SMBs Are
-FBI: Akira Gang Has Received Nearly $250 Million in Ransoms
-Companies Forced to Make Financial Changes After a Cyberattack
-Cyberattack Impact on Employees May Be as Serious as Technical Fallout
-UK’s New Cyber Security and Resilience Bill Targets Weak Links in Critical Services
-Spy Boss Says Authoritarian Nations Ready to Commit ‘High Impact Sabotage’
-Online Age Checking Is Creating a Treasure Trove of Data for Hackers
-Google Play Store Hosted 239 Malicious Apps That Were Downloaded 40 Million Times
-Android Malware Steals Your Card Details and PIN to Make Instant ATM Withdrawals
Executive Summary
We start this week with alerts on emerging attacks for business leaders and employees to act on. A new feature in Microsoft Teams gives attackers an easier route into organisations, while a leading developer of advanced AI systems has found hostile actors using its AI model to conduct real attacks. We also report how LinkedIn is used to bypass corporate email defences through direct, trusted-looking messages.
Once in, whether through these channels or others, attackers continue to deploy ransomware. Small and medium sized organisations are particularly targeted, and we highlight how incidents affect victims both financially and at a human level.
New cyber legislation is being introduced in the UK, while other countries warn of evolving nation-state threats. We also note the unintended consequences of regulatory requirements, where online age-verification data has created valuable targets for attackers. Finally, we flag malware risks in mobile phone applications found even in approved online stores.
Organisations need to understand developments in cyber security and take steps to strengthen resilience. Contact us to discuss how to do this proportionately and pragmatically.
Top Cyber Stories of the Last Week
Microsoft Teams’ New “Chat With Anyone” Feature Exposes Users To Phishing and Malware Attacks
A new feature in Microsoft Teams lets anyone initiate chats using only an email address, expanding opportunities for phishing and malicious file sharing. Commentators warn that attackers may bypass email defences and impersonate legitimate contacts. Administrators can disable the capability, and the piece recommends pairing configuration changes with training and MFA.
Source: https://cybersecuritynews.com/microsoft-teams-chat-with-anyone-feature/
Chinese Spies Told Claude To Break Into About 30 Critical Orgs. Some Attacks Succeeded
Anthropic identified a Chinese state linked group using its AI model Claude to support intrusions into around 30 high value organisations. Human operators directed strategy, while AI assisted with reconnaissance and coding tasks. The case shows growing attempts to blend human oversight with automated tools to streamline intrusions.
Source: https://www.theregister.com/2025/11/13/chinese_spies_claude_attacks/
5 Reasons Why Attackers Are Phishing Over LinkedIn
LinkedIn phishing is rising as attackers exploit direct messaging to bypass email defences. Compromised accounts from infostealer logs are used to impersonate real professionals, especially in finance and tech. The platform enables easy reconnaissance of roles and access levels. Commentators recommend better browser controls and monitoring of non email channels.
Source: https://www.bleepingcomputer.com/news/security/5-reasons-why-attackers-are-phishing-over-linkedin/
Cyber Insurers Paid Out Over Twice as Much for UK Ransomware Attacks Last Year
A steep rise in ransomware events has driven cyber insurance payouts up by 230%. Insurers report more destructive attacks and increased scrutiny of controls such as patching, backups and incident response before granting cover. While insurance supports recovery, it cannot replace core cyber security hygiene or resilience measures.
Source: https://www.theregister.com/2025/11/11/ransomware_surge_fuels_230_increase/
Large Organisations Aren’t Paying Ransomware Threats Anymore: SMBs Are
Proton, a privacy and security technology provider, reports a shift in attacker focus towards SMBs as large enterprises become less willing to pay. Median ransom payments dropped sharply, while unpatched vulnerabilities remained a leading cause of compromise. SMBs face rising exposure and should prioritise staff awareness, backups and segmentation to limit attacker movement and reduce impact.
Source: https://proton.me/blog/ransomware-threats-smbs
FBI: Akira Gang Has Received Nearly $250 Million in Ransoms
The Akira ransomware group has collected an estimated $244 million since 2023, mainly targeting small and medium sized organisations across multiple sectors. Attackers often exploit weak VPNs, stolen credentials and password spraying, then remove security tools and steal data rapidly. Authorities warn that Akira’s speed and use of legitimate remote access tools demand tighter monitoring and faster patching.
Source: https://therecord.media/akira-gang-received-million
Companies Forced to Make Financial Changes After a Cyberattack
A survey of firms hit by cyberattacks found that 70% of publicly traded companies adjusted earnings or guidance afterwards and 68% saw their stock price affected. Among privately held businesses, 73% diverted budgets away from innovation and growth. Additionally, 92% reported legal, regulatory or compliance consequences such as fines or lawsuits. The research emphasises that recovery from an attack involves far more than restoring systems; it demands financial and strategic overhaul.
Source: https://betanews.com/2025/11/10/companies-forced-to-make-financial-changes-after-a-cyberattack/
Cyberattack Impact on Employees May Be as Serious as Technical Fallout
A survey of 500 Irish businesses found 40% suffered an attack in the past year, with many reporting burnout, stress and increased sick leave. Some saw improved loyalty, but most faced financial harm and ransomware pressures. The report also found that AI related vulnerabilities are rising, yet firms still see AI as beneficial overall.
UK’s New Cyber Security and Resilience Bill Targets Weak Links in Critical Services
Proposed cyber security legislation in the UK will expand existing regulations to include MSPs, data centres and other essential suppliers. It introduces stricter security duties, 24 hour incident reporting and tougher enforcement powers. Operators of critical services would be required to notify impacted customers quickly and maintain stronger controls across supply chains.
Source: https://www.helpnetsecurity.com/2025/11/12/uk-cyber-security-and-resilience-bill/
Spy Boss Says Authoritarian Nations Ready to Commit ‘High Impact Sabotage’
Australia’s domestic intelligence and national security agency, ASIO, warns that hostile states are preparing for cyber sabotage targeting critical infrastructure. Officials cite recent probes by groups such as Volt Typhoon and Salt Typhoon. The director general urges boards to understand their operational dependencies and prepare for scenarios involving communications, power or water disruptions.
Source: https://www.theregister.com/2025/11/12/asio_cyber_sabotage_warnings/
Online Age Checking Is Creating a Treasure Trove of Data for Hackers
Age verification systems increasingly require photo IDs, selfies and credit card checks, creating sensitive data stores attractive to criminals. Breaches at Discord and the Tea app exposed large volumes of imagery and identity data despite policies stating minimal retention. The article argues that regulators lack sufficient power to enforce deletion, especially when third parties are offshore.
Google Play Store Hosted 239 Malicious Apps That Were Downloaded 40 Million Times
Researchers found 239 malicious Android apps on Play, totalling around 42 million downloads. Threats included spyware, banking trojans and adware, with detections rising 67% year on year. Google is tightening developer checks, but observers argue that serious malware continues to slip through, leaving users exposed.
Android Malware Steals Your Card Details and PIN to Make Instant ATM Withdrawals
A malware strain known as NGate records NFC payment data and PINs, allowing criminals to emulate victims’ cards at cash machines. It spreads through phishing and fake banking apps. Users are advised to avoid unsolicited downloads, use trusted app stores and deploy mobile security tools to reduce risk.
Governance, Risk and Compliance
The quiet revolution: How regulation is forcing cybersecurity accountability | CyberScoop
Nearly £200 million paid in cyber claims to help UK businesses recover | ABI
Cyberattack impact on employees may be as serious as technical fallout
Three quarters of SMEs unprotected against everyday risks - CIR Magazine
Companies forced to make financial changes after a cyberattack - BetaNews
The changing language of cyber: communicating with the board | IT Pro
Why Cybersecurity Must Shift To Continuous Incident Response
The Professionalised World of Cybercrime and the New Arms Race - Security Boulevard
Cyberattacks forcing businesses to correct financial outlooks - CIR Magazine
AI is forcing boards to rethink how they govern security - Help Net Security
Cyber Execs Get Insurance, Legal Counsel Perks Amid Higher Risks
CISOs: More Pressure from Internal Expectations than External Threats | MSSP Alert
CISOs are cracking under pressure - Help Net Security
To get funding, CISOs are mastering the language of money - Help Net Security
Reducing the risk of major cyber incidents in the UK through digital resilience | UKAuthority
Threats
Ransomware, Extortion and Destructive Attacks
Qilin Ransomware Activity Surges as Attacks Target Small Businesses - Infosecurity Magazine
Are SMBs facing increasing ransomware threats? | Proton
Ransomware fuels 230% increase in UK cyber insurance payouts • The Register
Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware
Cyberattacks 'costing the UK economy £14.7 billion' a year
Kraken ransomware benchmarks systems for optimal encryption choice
FBI: Akira gang has received nearly $250 million in ransoms | The Record from Recorded Future News
FBI calls Akira ‘top five’ ransomware variant out of 130 targeting US businesses | CyberScoop
'Ransomvibing' Infests Visual Studio Extension Market
Yanluowang initial access broker pleaded guilty to ransomware attacks
How a CPU spike led to uncovering a RansomHub ransomware attack
Russian Hacking Group Sandworm Deploys New Wiper Malware in Ukraine - Infosecurity Magazine
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
The ransomware payment ban: what’s the potential impact for UK businesses? | TechRadar
Russian pleads guilty, staring at 53 years and $9.2M penalty - Cryptopolitan
Ransomware Victims
Allianz UK confirms Oracle EBS compromise • The Register
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site - SecurityWeek
Synnovis Finally Issues Breach Notification After 2024 Ransomware Atta - Infosecurity Magazine
Hackers claim to leak Collins Aerospace data | Cybernews
UK economic growth slows due to cyberattack at Jaguar Land Rover
UK NHS Named in Clop Gang's Exploits of Oracle Zero-Days
Bank of England says JLR's cyberattack damaged UK GDP growth • The Register
Washington Post data breach impacts nearly 10K employees, contractors
Government not handing ‘free money’ to JLR after cyber attack, minister insists | Insider Media
GlobalLogic Becomes Latest Cl0p Victim After Oracle EBS Attack - Infosecurity Magazine
Ransomed CTO falls on sword, refuses to pay extortion demand • The Register
DoorDash hit by new data breach in October exposing user information
Phishing & Email Based Attacks
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
5 reasons why attackers are phishing over LinkedIn
AI and phishing: a toxic pair | Professional Security Magazine
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
New Phishing Attack Leverages Popular Brands to Harvest Login Credentials - Cyber Security News
Google Looks to Dim 'Lighthouse' Phishing Kit
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Cyberattacks 'costing the UK economy £14.7 billion' a year
Other Social Engineering
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
Attackers upgrade ClickFix with tricks used by online stores - Help Net Security
ClickFix Attacks Against macOS Users Evolving - SecurityWeek
What is FileFix — a ClickFix variation? | Kaspersky official blog
ClickFix may be the biggest security threat your family has never heard of - Ars Technica
5 reasons why attackers are phishing over LinkedIn
Phishers target 5K Facebook advertisers with fake biz pages • The Register
Beware the 'Hi, how are you?' text. It's a scam - here's how it works | ZDNET
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Wanna bet? Scammers are playing the odds better than you are - Help Net Security
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Google goes after massive phishing enterprise behind those spammy USPS messages - Neowin
Fraud, Scams and Financial Crime
Cyberattacks 'costing the UK economy £14.7 billion' a year
Beware the 'Hi, how are you?' text. It's a scam - here's how it works | ZDNET
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Wanna bet? Scammers are playing the odds better than you are - Help Net Security
$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK
"Vibescamming" is the new online scam everyone’s falling for
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data
Google goes after massive phishing enterprise behind those spammy USPS messages - Neowin
Google Looks to Dim 'Lighthouse' Phishing Kit
New NCA Campaign Warns Men Off Crypto Investment Scams - Infosecurity Magazine
'Dodgy' Amazon Fire TV sticks are leaving users open to financial fraud | News Tech | Metro News
Improve Collaboration to Hit Back At Rising Fraud, Says techUK - Infosecurity Magazine
Lost iPhone? Don’t fall for phishing texts saying it was found
How Elder Fraud Reveals Gaps in Human-Centric Security
Artificial Intelligence
Survey Surfaces Sharp Rise in Cybersecurity Incidents Involving AI - Security Boulevard
"Vibescamming" is the new online scam everyone’s falling for
AI and phishing: a toxic pair | Professional Security Magazine
Cybercriminals Are Now Using AI to Create Shape-Shifting Malware, Google Warns
AI Agents Are Going Rogue: Here's How to Rein Them In
65% of Leading AI Companies Found With Verified Secrets Leaks - Infosecurity Magazine
Advocacy group calls on OpenAI to address Sora 2’s deepfake risks | CyberScoop
Los Alamos researchers warn AI may upend national security - Help Net Security
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
AI chat privacy at risk: Microsoft details Whisper Leak side-channel attack
Military experts warn security hole in most AI chatbots can sow chaos
Execs Say AI Use is Making Companies Vulnerable to Attacks: Survey | MSSP Alert
Many Forbes AI 50 Companies Leak Secrets on GitHub - SecurityWeek
Shadow AI risk: Navigating the growing threat of ungoverned AI adoption - Help Net Security
Legal Reputations at Risk: How AI is Reshaping Cyber Threats in Law – Artificial Lawyer
'Ransomvibing' Infests Visual Studio Extension Market
Autonomous AI could challenge how we define criminal behavior - Help Net Security
Oddest ChatGPT leaks yet: Cringey chat logs found in Google analytics tool - Ars Technica
Malware
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
Hackers Exploiting RMM Tools LogMeIn and PDQ Connect to Deploy Malware as a Normal Program
Cybercriminals Are Now Using AI to Create Shape-Shifting Malware, Google Warns
Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware
Infostealers are making this old security practice new again | PCWorld
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
Hackers Weaponizing Calendar Files as a New Attack Vector Bypassing Traditional Email Defenses
Threat Actors Attacking Outlook and Google Bypassing Traditional Email Defenses
DanaBot malware is back to infecting Windows after 6-month break
Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack
GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites
Rhadamanthys infostealer disrupted as cybercriminals lose server access
Ferocious Kitten APT Deploying MarkiRAT to Capture Keystroke and Clipboard Logging
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium - SecurityWeek
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation
Hackers abuse Triofox antivirus feature to deploy remote access tools
Bots/Botnets
A new round of Europol’s Operation Endgame dismantled Rhadamanthys, Venom RAT, and Elysium botnet
Mobile
Beware the 'Hi, how are you?' text. It's a scam - here's how it works | ZDNET
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
Google Play Store hosted 239 malicious apps that were downloaded 40 million times - gHacks Tech News
Warning! Don't open these WhatsApp images, else you'll get hacked | PCWorld
New Android Malware ‘Fantasy Hub’ Intercepts SMS Messages, Contacts and Call Logs
Android malware steals your card details and PIN to make instant ATM withdrawals | Malwarebytes
Android Devices Targeted by KONNI APT in Find Hub Exploitation - Infosecurity Magazine
Popular Android-based photo frames download malware on boot
Lost iPhone? Don’t fall for phishing texts saying it was found
Denial of Service/DoS/DDoS
Cisco: Actively exploited firewall flaws now abused for DoS attacks
Multiple Django Vulnerabilities Enable SQL injection and DoS Attack
Cyberattack hits Danish government and defence companies | European Pravda
Internet of Things – IoT
UK.gov probes security risks of Chinese electric buses • The Register
Data Breaches/Leaks
Allianz UK confirms Oracle EBS compromise • The Register
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site - SecurityWeek
65% of Leading AI Companies Found With Verified Secrets Leaks - Infosecurity Magazine
Synnovis Finally Issues Breach Notification After 2024 Ransomware Atta - Infosecurity Magazine
Hackers claim to leak Collins Aerospace data | Cybernews
UK NHS Named in Clop Gang's Exploits of Oracle Zero-Days
AI chat privacy at risk: Microsoft details Whisper Leak side-channel attack
Military experts warn security hole in most AI chatbots can sow chaos
Execs Say AI Use is Making Companies Vulnerable to Attacks: Survey | MSSP Alert
Many Forbes AI 50 Companies Leak Secrets on GitHub - SecurityWeek
Legal Reputations at Risk: How AI is Reshaping Cyber Threats in Law – Artificial Lawyer
Washington Post data breach impacts nearly 10K employees, contractors
Website Security Breaches: 13 Lessons Learned from Small Businesses - DevX
Whisper Leak: A novel side-channel attack on remote language models | Microsoft Security Blog
GlobalLogic Becomes Latest Cl0p Victim After Oracle EBS Attack - Infosecurity Magazine
New IT woe at Legal Aid Agency | Law Gazette
Oddest ChatGPT leaks yet: Cringey chat logs found in Google analytics tool - Ars Technica
Organised Crime & Criminal Actors
The Professionalised World of Cybercrime and the New Arms Race - Security Boulevard
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Yanluowang initial access broker pleaded guilty to ransomware attacks
Autonomous AI could challenge how we define criminal behavior - Help Net Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK
New NCA Campaign Warns Men Off Crypto Investment Scams - Infosecurity Magazine
Insider Risk and Insider Threats
Cyberattack impact on employees may be as serious as technical fallout
Insurance
Ransomware fuels 230% increase in UK cyber insurance payouts • The Register
Cyber insurance pay-outs triple | Professional Security Magazine
Nearly £200 million paid in cyber claims to help UK businesses recover | ABI
Cyber Execs Get Insurance, Legal Counsel Perks Amid Higher Risks
Supply Chain and Third Parties
Allianz UK confirms Oracle EBS compromise • The Register
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site - SecurityWeek
Synnovis notifies of data breach after 2024 ransomware attack
Synnovis Finally Issues Breach Notification After 2024 Ransomware Atta - Infosecurity Magazine
GlobalLogic Becomes Latest Cl0p Victim After Oracle EBS Attack - Infosecurity Magazine
Cloud/SaaS
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
Microsoft's data sovereignty: Now with extra sovereignty! • The Register
Identity and Access Management
Active Directory Under Siege: Why Critical Infrastructure Needs Stronger Security
Encryption
Are we ready for the post-quantum era? | TechRadar
Linux and Open Source
CISA warns of Akira ransomware Linux encryptor targeting Nutanix VMs
Passwords, Credential Stuffing & Brute Force Attacks
New Phishing Attack Leverages Popular Brands to Harvest Login Credentials - Cyber Security News
Enterprise Credentials at Risk – Same Old, Same Old?
Social Media
5 reasons why attackers are phishing over LinkedIn
Phishers target 5K Facebook advertisers with fake biz pages • The Register
The common social media security measure that creates a treasure trove for hackers | The Independent
Online age checking is creating a treasure trove of data for hackers
New Age Verification Bills Could Ban VPNs, Jeopardize the Privacy of Millions - CNET
Regulations, Fines and Legislation
ID verification laws are fueling the next wave of breaches
New Age Verification Bills Could Ban VPNs, Jeopardize the Privacy of Millions - CNET
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
Cyber bill offers 'no guarantee of security', tech lawyer says - UKTN
Exclusive: Ofcom is monitoring VPNs following Online Safety Act. Here's how | TechRadar
The Government Shutdown Is a Ticking Cybersecurity Time Bomb | WIRED
China amends its Cybersecurity Law
America’s cybersecurity defenses are cracking | The Verge
Cyber information sharing law would get extension under shutdown deal bill | CyberScoop
CISA, FCEA funding set to resume as shutdown nears its end • The Register
Age verification lands in Italy − here’s how it affects VPN users | TechRadar
Models, Frameworks and Standards
A guide to the UK Cyber Security and Resilience Bill (CSRB) | Professional Security Magazine
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
Broken access control still tops list of app sec top 10 • The Register
Data Protection
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
Careers, Working in Cyber and Information Security
CISOs are cracking under pressure - Help Net Security
CISO Pay Packages Grow as Overall Security Spending Slows: IANS | MSSP Alert
From Forensics to AI: New bulletin maps out Cyber Security careers | Department for the Economy
Why We Need More Veterans in Intelligence, Cybersecurity, and STEM - ClearanceJobs
Resilience for resilience: Managing burnout among cyber leaders | Computer Weekly
The New Battlefield: 3 Veterans Discuss Their Transition to Cybersecurity | Security Magazine
Cyber Execs Get Insurance, Legal Counsel Perks Amid Higher Risks
Law Enforcement Action and Take Downs
$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium - SecurityWeek
New NCA Campaign Warns Men Off Crypto Investment Scams - Infosecurity Magazine
Yanluowang initial access broker pleaded guilty to ransomware attacks
Russian hacker admits helping Yanluowang ransomware infect companies
Russian pleads guilty, staring at 53 years and $9.2M penalty - Cryptopolitan
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Spy boss says authoritarian nations poised for sabotage • The Register
Los Alamos researchers warn AI may upend national security - Help Net Security
From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools
Data breach at Chinese infosec firm reveals weapons arsenal • The Register
Russia's suspected 'hybrid war' puts European air defences to the test | The Straits Times
War continues in cyberspace: Final cybersecurity education session concludes in Kyiv
TP-Link Routers Could Soon Be Banned. Here's What Cybersecurity Experts Say About the Risk - CNET
The threat of space terrorism is no longer science fiction, but we’re ill-prepared to combat it
Nation State Actors
China
Spy boss says authoritarian nations poised for sabotage • The Register
Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign - SecurityWeek
Chinese spies used Claude to break into critical orgs • The Register
From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools
Data breach at Chinese infosec firm reveals weapons arsenal • The Register
UK.gov probes security risks of Chinese electric buses • The Register
Denmark and Norway investigate Yutong bus security flaw amid rising tech fears
TP-Link Routers Could Soon Be Banned. Here's What Cybersecurity Experts Say About the Risk - CNET
China amends its Cybersecurity Law
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Palantir CEO Says a Surveillance State Is Preferable to China Winning the AI Race
Russia
Russia's suspected 'hybrid war' puts European air defences to the test | The Straits Times
War continues in cyberspace: Final cybersecurity education session concludes in Kyiv
Russian Hacking Group Sandworm Deploys New Wiper Malware in Ukraine - Infosecurity Magazine
Russian pleads guilty, staring at 53 years and $9.2M penalty - Cryptopolitan
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data
Belgian military intelligence service websites attacked by Russian hackers | VRT NWS: news
Russian hacker admits helping Yanluowang ransomware infect companies
Iran
Ferocious Kitten APT Deploying MarkiRAT to Capture Keystroke and Clipboard Logging
North Korea
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
Android Devices Targeted by KONNI APT in Find Hub Exploitation - Infosecurity Magazine
[Editorial] The silent war - The Korea Herald
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Emulating the Espionage-Oriented Group SideWinder - Security Boulevard
Tools and Controls
Hackers Exploiting RMM Tools LogMeIn and PDQ Connect to Deploy Malware as a Normal Program
Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware
Why Cybersecurity Must Shift To Continuous Incident Response
Online age checking is creating a treasure trove of data for hackers
New Age Verification Bills Could Ban VPNs, Jeopardize the Privacy of Millions - CNET
Ransomware fuels 230% increase in UK cyber insurance payouts • The Register
Cisco: Actively exploited firewall flaws now abused for DoS attacks
AI is forcing boards to rethink how they govern security - Help Net Security
ISO - Threat intelligence and why it matters for cybersecurity
Controversy Brews: US Government Targets Banning Top Wi-Fi Router - CNET
Broken access control still tops list of app sec top 10 • The Register
Exclusive: Ofcom is monitoring VPNs following Online Safety Act. Here's how | TechRadar
Resilience and AI risk | Professional Security Magazine
Automation can't fix broken security basics - Help Net Security
The browser is eating your security stack - Help Net Security
CISA warns of Akira ransomware Linux encryptor targeting Nutanix VMs
Active Directory Under Siege: Why Critical Infrastructure Needs Stronger Security
Age verification lands in Italy − here’s how it affects VPN users | TechRadar
To get funding, CISOs are mastering the language of money - Help Net Security
Reducing the risk of major cyber incidents in the UK through digital resilience | UKAuthority
NCSC Set to Retire Web Check and Mail Check Tools - Infosecurity Magazine
Other News
Who Owns the Cybersecurity of Space? - DataBreachToday
Europe Must Close the Space Gap by Anders Fogh Rasmussen - Project Syndicate
Logistics companies are increasingly targeted by cybercriminals | CargoForwarder Global
Telecoms Cyber Chiefs Adopt Financial Sector’s Model of Collective Defense - WSJ
Vulnerability Management
When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security
Microsoft: Windows 11 23H2 Home and Pro reach end of support
Vulnerabilities
Cisco: Actively exploited firewall flaws now abused for DoS attacks
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
Cisco fixes critical UCCX flaw allowing Root command execution
SAP fixed a maximum severity flaw in SQL Anywhere Monitor
Zoom Workplace for Windows Vulnerability Allow Users to Escalate Privilege
Chipmaker Patch Tuesday: Over 60 Vulnerabilities Patched by Intel - SecurityWeek
High-Severity Vulnerabilities Patched by Ivanti and Zoom - SecurityWeek
Firefox 145 and Chrome 142 Patch High-Severity Flaws in Latest Releases - SecurityWeek
CitrixBleed 2, Cisco Flaw Wreak Havoc as Zero-Day Bugs
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
Microsoft Exchange 'Under Imminent Threat', Act Now
Fortinet FortiWeb flaw with public PoC exploited to create admin users
Palo Alto PAN-OS Firewall Vulnerability Let Attackers Reboot Firewall by Sending Malicious Packet
Android Devices Targeted by KONNI APT in Find Hub Exploitation - Infosecurity Magazine
Multiple Django Vulnerabilities Enable SQL injection and DoS Attack
Dangerous runC flaws could allow hackers to escape Docker containers
Adobe Patches 29 Vulnerabilities - SecurityWeek
Hackers abuse Triofox antivirus feature to deploy remote access tools
QNAP fixes seven NAS zero-day flaws exploited at Pwn2Own
Critical Triofox Vulnerability Exploited in the Wild - SecurityWeek
RCE flaw in ImunifyAV puts millions of Linux-hosted sites at risk
ChatGPT Vulnerability Exposed Underlying Cloud Infrastructure - SecurityWeek
Synology fixes BeeStation zero-days demoed at Pwn2Own Ireland
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Advisory - 12 November 2025 - Security Updates from Microsoft, Adobe and SAP
Black Arrow Cyber Advisory - 12 November 2025 - Security Updates from Microsoft, Adobe and SAP
Executive Summary
This month’s Patch Tuesday features updates from Microsoft, Adobe and SAP. Microsoft’s release spans Windows, Microsoft 365/Office components and server/identity platforms. Adobe has posted product-specific advisories across its portfolio. SAP published its November Patch Day with a notable volume of new Security Notes. Prioritise internet-facing systems, identity infrastructure and widely deployed desktop applications, with emphasis on critical remote code execution and privilege escalation fixes.
Vulnerabilities by Vendor
Microsoft addressed 63 vulnerabilities impacting Windows, Windows Components, Office, Office Components, Edge, Azure Monitor Agent, Dynamics 365, Hyper-V, SQL Server, and WSL (Windows Subsystem for Linux) GUI. Four of these vulnerabilities are rated as Critical and 59 are rated Important. No vulnerabilities addressed this month were publicly known at the time of release and none are known to be under active exploitation.
Adobe updated addresses 29 vulnerabilities across InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins products. Critical arbitrary code execution vulnerabilities were addressed in InDesign, InCopy, Photoshop, Illustrator, Substance 3D Stager, and Format Plugins. Adobe says there is no evidence that any of these vulnerabilities are known to have been exploited in the wild.
SAP addressed 19 security vulnerabilities this month, including a critical flaw in SQL Anywhere Monitor and other vulnerabilties relating to Solution Manager, CommonCryptoLib, NetWeaver AS ABAP/Java, S/4HANA components, Business Connector, SAP GUI.
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
For more information:
Microsoft — https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov
Adobe — https://helpx.adobe.com/security/security-bulletin.html
SAP — https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html
Black Arrow Cyber Threat Intelligence Briefing 07 November 2025
Black Arrow Cyber Threat Intelligence Briefing 07 November 2025:
-Enterprises are Not Prepared for a World of Malicious AI Agents
-The Phishing Renaissance, How AI Brought Back the Classics
-‘Data Sprawl’ Is Now Your Security Team’s Biggest Headache – And It’s Only Going to Get Worse
-Old Threats, New Consequences: 90% of Cyber Claims Stem from Email and Remote Access
-Survey: Organisations are Too Confident in Their Cyber Resiliency
-Thousands Fall Victim to Ransomware as European Attacks Reach Record Highs - Here’s Why They’re So at Risk
-How Ransomware Attacks Leverage Cyber Insurance Policies
-Violent Cybercrime Surges in Europe Amid Big Payouts
-Three of the Biggest Cybercrime Gangs Around Appear to Be Teaming Up - Which Could Be Bad News for All of Us
-Google Says 2026 Will Be the Year AI Supercharges Cybercrime
-Enterprises are Losing Track of the Devices Inside Their Networks
-Britain ‘Highly Vulnerable’ to Russian Cyber Attacks, Warns Former Army Chief
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week’s stories highlight how AI is reshaping cyber threats, with malicious agents, deepfakes and automated phishing increasing both scale and sophistication. In particular, when AI agents are given their own credentials or identities, this increases the risks that are exploited by attackers. Business leaders must now consider AI-driven risks as part of their core governance responsibilities. Risks are further increased because of the growth of data held by businesses, including redundant or abandoned data.
We also report on the resurgence of classic attack methods like phishing and email compromise, now supercharged by generative AI. Ransomware remains a dominant threat, with attackers exploiting cyber insurance policies and even resorting to physical intimidation. European organisations are particularly exposed, and many still pay ransoms, which encourages repeat targeting. Research shows that business leaders have an inaccurate perception of their organisation’s readiness to recover from an incident.
The key theme here is the need for business leaders to be informed of the current and emerging threats to their business, and to know how to mitigate these risks through a strategy that they govern alongside their other risks. Contact us to discuss how to make this work proportionately in your organisation.
Top Cyber Stories of the Last Week
Enterprises are Not Prepared for a World of Malicious AI Agents
Palo Alto Networks CEO Nikesh Arora warns that most organisations are ill equipped to manage the growing number of AI agents accessing corporate systems. These non-human identities can act like employees, holding credentials and privileges that expand the attack surface. Existing identity and privileged access tools track only a fraction of users, leaving many AI agents unmonitored. This gap will worsen as both legitimate and malicious agents proliferate. A centralised management of user access and permissions is needed to prevent uncontrolled access and misuse.
Source: https://www.zdnet.com/article/enterprises-are-not-prepared-for-a-world-of-malicious-ai-agents/
The Phishing Renaissance, How AI Brought Back the Classics
Classic phishing methods such as credential theft and vendor impersonation are resurging because AI makes personalisation easy. Generative tools remove the grammatical errors that once revealed scams, allowing criminals to adapt tone and context for each target. Deepfakes and voice cloning add realism to social engineering, while business email compromise continues to succeed without malware. Human awareness and layered verification are essential as AI amplifies the effectiveness of old techniques.
Source: https://securityboulevard.com/2025/10/the-phishing-renaissance-how-ai-brought-back-the-classics/
‘Data Sprawl’ Is Now Your Security Team’s Biggest Headache – And It’s Only Going to Get Worse
Growth of data across cloud, hybrid and SaaS environments is overwhelming security teams. One-third of UK organisations saw data volumes surge by 30% or more in the past year and 41% of large enterprises now manage over a petabyte. Around 38% flag redundant or abandoned data as a security risk, while 85% of organisations globally report data loss incidents. The rise of generative AI and weak visibility are exacerbating the issue, and firms should embed privacy-by-design and governance before attackers exploit the chaos.
Old Threats, New Consequences: 90% of Cyber Claims Stem from Email and Remote Access
Insurance data shows that most cyber claims originate from email and remote access breaches. Email accounted for 43% of incidents in 2024, with claim frequency rising 30% year on year. Fraud often begins with inbox compromise or near lookalike domains, and average illicit transfers reached $286,000. Generative AI is accelerating attacker success, highlighting that familiar entry points remain the most costly for organisations.
Survey: Organisations are Too Confident in Their Cyber Resiliency
A global study of 1,773 leaders finds widespread overconfidence in cyber resilience. While 95% believe they can recover from ransomware, 40% were attacked in the past year and only 15% fully restored their data. 45% paid ransoms, with 30% paying over $250,000. 44% report deepfake enabled attacks and many lack clear policies on generative AI. The findings reveal a gap between perceived and actual preparedness.
Thousands Fall Victim to Ransomware as European Attacks Reach Record Highs - Here’s Why They’re So at Risk
Europe now accounts for almost 22% of global victims posted on leak sites since 2024, with more than 2,100 European organisations listed. Exposure is driven by lucrative sectors, GDPR penalties that can encourage payment and geopolitical spillover from the war in Ukraine. Average time from initial access to deployment is 35.5 hours, compressing response windows and increasing operational impact. Intelligence led defence and faster containment are essential.
How Ransomware Attacks Leverage Cyber Insurance Policies
Attackers increasingly search for cyber insurance documents to shape negotiations. Knowledge of limits, coverage and approved vendors allows demands that appear reasonable relative to downtime and costs. Policies should be protected like confidential financial records, with strict access, secure storage, offline copies and staff awareness to prevent leverage during extortion.
Source: https://securityboulevard.com/2025/11/how-ransomware-attacks-leverage-cyber-insurance-policies/
Violent Cybercrime Surges in Europe Amid Big Payouts
Some cyber attackers are pairing online extortion with real world intimidation to force payment. Rising revenues and professionalisation are driving aggression, with threats extending beyond data leaks. Response plans should include physical safety considerations and coordination with law enforcement as pressure tactics escalate.
Source: https://www.theregister.com/2025/11/04/cybercriminals_increasingly_rely_on_violence/
Three of the Biggest Cybercrime Gangs Around Appear to Be Teaming Up - Which Could Be Bad News for All of Us
Scattered Spider, Lapsus$ and ShinyHunters have reportedly united under the new banner “Scattered Lapsus$ Hunters” (SLH). Operating via Telegram, the alliance combines social engineering, credential theft and data-leak extortion into a professionalised “Extortion-as-a-Service” model. The groups seek both profit and notoriety, marking a shift toward cybercrime branding that increases visibility and risk for global enterprises.
Google Says 2026 Will Be the Year AI Supercharges Cybercrime
Google forecasts that by 2026, AI will drive both attacks and defences. Adversaries will automate phishing, deepfakes and prompt injection exploits against large language models. A growing concern is unmonitored bots or scripts with system access that act without oversight; these hidden identities could move data or perform actions unseen by security teams. The report urges strict control, identity tracking and AI-led containment to counter this evolving threat.
Source: https://www.helpnetsecurity.com/2025/11/05/google-cybersecurity-forecast-2026/
Enterprises are Losing Track of the Devices Inside Their Networks
A study of 10 million devices across more than 700 organisations shows that two-thirds are not traditional IT assets such as servers or laptops. Instead, they include extended IoT devices like VoIP phones, cameras, point-of-sale systems and power supplies. On average, firms manage 164 device types, 1,629 vendors and 876 OS versions. With 40% of cameras containing known flaws and 3% exposed online, organisations must urgently regain visibility and control over every connected device.
Source: https://www.helpnetsecurity.com/2025/11/06/enterprise-xiot-devices-risk/
Britain ‘Highly Vulnerable’ to Russian Cyber Attacks, Warns Former Army Chief
Field Marshal Lord Houghton warns that Britain’s cyber defences are not yet fit for purpose and that the nation remains highly vulnerable to hostile cyber activity. Recent breaches affecting the Ministry of Defence and major contractors highlight deep weaknesses. He urges greater investment in AI and autonomous systems to boost military capability and calls for closer coordination between government, industry and the Armed Forces to strengthen resilience.
Source: https://www.telegraph.co.uk/news/2025/11/06/british-army-russian-attack-field-marshal-lord-houghton/
Governance, Risk and Compliance
82 percent of finserv organizations suffered a data breach in the last year - BetaNews
CISO Burnout – Epidemic, Endemic, or Simply Inevitable? - SecurityWeek
Survey: Organizations Are Too Confident in Their Cyber Resiliency - Security Boulevard
Financial services can't shake security debt - Help Net Security
UK’s National Cyber Security Centre Releases 2025 Annual Review | Alston & Bird - JDSupra
Google Forecasts Rise of Cyber-Physical Attacks Targeting Europe - Infosecurity Magazine
Nation-State, Cyber and Hacktivist Threats Pummel Europe
Violent cybercrime surges in Europe amid big payouts • The Register
Firms prioritise AI and cyber security in tackling digital threats - CIR Magazine
The Next Evolution Of Cybersecurity Is Preemptive
Gartner just dropped its 2026 tech trends - and it's not all AI: Here's the list | ZDNET
To maximize their influence, CISOs need diverse skills | TechTarget
CISOs in court: Balancing cyber resilience and legal accountability | Computer Weekly
Threats
Ransomware, Extortion and Destructive Attacks
Cyber loot flows to Russia and its friends | Cybernews
What Makes Ransomware Groups Successful?
Rhysida ransomware exploits Microsoft certificate to slip malware past defenses | CSO Online
Cybersecurity experts charged with running BlackCat ransomware operation | CSO Online
Ransomware attacks are hitting European enterprises at record pace | IT Pro
Leak Site Ransomware Victims Spike 13% in a Year - Infosecurity Magazine
Beware - ransomware gang is tricking victims with fake Microsoft Teams ads | TechRadar
How Ransomware Attacks Leverage Cyber Insurance Policies - Security Boulevard
DragonForce Cartel Emerges as Conti-Derived Ransomware Threat - Infosecurity Magazine
U.S. Sanctions 10 North Korean Entities for Laundering $12.7M in Crypto and IT Fraud
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
Ongoing Ransomware Attacks Exploit Linux Vulnerability, CISA Warns
Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine - Ars Technica
Ukrainian allegedly involved in Conti ransomware attacks faces up to 25 years in jail | CyberScoop
Ransomware Victims
Conduent January 2025 breach impacts 10M+ people
M&S cyberattack cost £136m but retailer ‘regaining momentum’ | News | The Grocer
Results: Cyber attack more than halved M&S first half profits - Retail Gazette
Hackers hit a Swiss bank, claiming 2.5TB of data | Cybernews
How a ransomware gang encrypted Nevada government's systems
Nevada Refused to Pay Cyberattack Ransom as Systems Sat Compromised for Months – DataBreaches.Net
Apache OpenOffice disputes data breach claims by ransomware gang
"Pay up or we share the tapes": Hackers target massage parlour clients in blackmail scheme
Oncology Institute Reports Cybersecurity Incident Impact - TipRanks.com
Phishing & Email Based Attacks
The Phishing Renaissance, How AI Brought Back the Classics - Security Boulevard
Old threats, new consequences: 90% of cyber claims stem from email and remote access | CSO Online
ClickFix malware attacks evolve with multi-OS support, video tutorials
How Phishing Kits Are Evading Detection & Ways to Beat Them | MSSP Alert
Is your business prepared for these growing phishing scams? | TechRadar
“I Paid Twice” Phishing Campaign Targets Booking.com - Infosecurity Magazine
Other Social Engineering
ClickFix malware attacks evolve with multi-OS support, video tutorials
In an AI World, Every Attack is a Social Engineering Attack - Security Boulevard
Is your business ready for a deepfake attack? 4 steps to take before it's too late | ZDNET
Cybercriminals have built a business on YouTube’s blind spots - Help Net Security
UK carriers to block spoofed phone numbers in fraud crackdown
SMS Fraud Losses Set to Decline 11% in 2026 - Infosecurity Magazine
Sora 2 Creates Believable Videos,Reality Checks Needed
AI makes holiday shopping scams harder to spot - BetaNews
Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries
Fraud, Scams and Financial Crime
Europe's phone networks are drowning in fake calls - Help Net Security
Google Report Reveals How Text Scams Steal Your Data And Money
Cybercriminals have built a business on YouTube’s blind spots - Help Net Security
UK carriers to block spoofed phone numbers in fraud crackdown
SMS Fraud Losses Set to Decline 11% in 2026 - Infosecurity Magazine
AI makes holiday shopping scams harder to spot - BetaNews
Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries
Experts warn AI tools are fueling a rise in scams targeting older adults - BetaNews
Artificial Intelligence
The Phishing Renaissance, How AI Brought Back the Classics - Security Boulevard
Ransomware Attack on European Organizations Surge as Hackers Leveraging AI-Tools for Attacks
Google says 2026 will be the year AI supercharges cybercrime - Help Net Security
Cybercrime To Hit Critical Supply Chains As AI Amplifies Global Risk, Google Warns | Scoop News
Cybercriminals Armed With AI Often Find Mid-Sized Businesses Are Sitting Ducks | Law.com
Enterprises are not prepared for a world of malicious AI agents | ZDNET
List of AI Tools Promoted by Threat Actors in Underground Forums and Their Capabilities
In an AI World, Every Attack is a Social Engineering Attack - Security Boulevard
Is your business ready for a deepfake attack? 4 steps to take before it's too late | ZDNET
Google uncovers malware using LLMs to operate and evade detection - Help Net Security
Malware Now Uses AI During Execution to Mutate and Collect Data, Google Warns - SecurityWeek
Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data
The cottage industry quietly manipulating chatbots’ replies
Sora 2 Creates Believable Videos,Reality Checks Needed
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities
Tech groups step up efforts to solve AI’s big security flaw
Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel
Claude Desktop Extensions Vulnerable to Web-Based Prompt Injection - Infosecurity Magazine
Microsoft: A key OpenAI API is being used for 'espionage' by bad actors | Mashable
AI makes holiday shopping scams harder to spot - BetaNews
Google Threat Report Links AI-powered Malware to DPRK Crypto Theft - Decrypt
Malware
Google uncovers malware using LLMs to operate and evade detection - Help Net Security
New malware uses AI to adapt during attacks, report finds | The Record from Recorded Future News
ClickFix malware attacks evolve with multi-OS support, video tutorials
Weaponized Putty and Teams Ads Deliver Malware Allowing Hackers to Access Network
Chinese APT Uses 'Airstalk' Malware in Supply Chain Attacks - SecurityWeek
Russian hackers abuse Hyper-V to hide malware in Linux VMs
Rhysida ransomware exploits Microsoft certificate to slip malware past defenses | CSO Online
Australia warns of BadCandy infections on unpatched Cisco devices
Fake Solidity VSCode extension on Open VSX backdoors developers
Gootloader malware is back with new tricks after 7-month break
Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea
Russian hackers hit Windows machines via Linux VMs with new custom malware | TechRadar
Mobile
Europe's phone networks are drowning in fake calls - Help Net Security
Google Report Reveals How Text Scams Steal Your Data And Money
Android Malware Mutes Alerts, Drains Crypto Wallets
Backdoored ‘secure’ messaging app leads to more arrests • The Register
Report finds 67% surge in Android mal... - Mobile World Live
Malicious Android apps on Google Play downloaded 42 million times
Xi Jinping jokes about backdoors in Xiaomi smartphones • The Register
Denial of Service/DoS/DDoS
Hacktivist-Driven DDoS Dominates Attacks on Public Sector - Infosecurity Magazine
Internet of Things – IoT
The Hidden Risks of Third-Party IoT Devices: What Organizations Need t - Infosecurity Magazine
Why millions of connected vehicles need automated cyber security | TechRadar
Enterprises are losing track of the devices inside their networks - Help Net Security
An 18-Year-Old Codebase Left Smart Buildings Wide Open
Connected devices may face mandatory security checks before you can use them
Data Breaches/Leaks
82 percent of finserv organizations suffered a data breach in the last year - BetaNews
Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data
Conduent January 2025 breach impacts 10M+ people
Hackers hit a Swiss bank, claiming 2.5TB of data | Cybernews
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
Court reimposes original sentence for Capital One hacker | CyberScoop
Lawmakers say stolen police logins are exposing Flock surveillance cameras to hackers | TechCrunch
Washington Post says it is among victims of cyber breach tied to Oracle software | Reuters
Software dev accidentally leaks Australian govt documents | Information Age | ACS
Data breach at major Swedish software supplier impacts 1.5 million
US Congressional Budget Office hit by cybersecurity incident | Reuters
Apache OpenOffice disputes data breach claims by ransomware gang
Media giant Nikkei reports data breach impacting 17,000 people
Hyundai AutoEver America data breach exposes SSNs, drivers licenses
Organised Crime & Criminal Actors
Scattered Spider, ShinyHunters and LAPSUS$ Form Unified Collective - Infosecurity Magazine
DragonForce Cartel Emerges as Conti-Derived Ransomware Threat - Infosecurity Magazine
‘Scamming became the new farming’: inside India’s cybercrime villages | Cybercrime | The Guardian
Cyber surveillance of British businesses | Professional Security Magazine
Operation Chargeback Uncovers €300m Fraud Scheme in 193 Countries - Infosecurity Magazine
Court reimposes original sentence for Capital One hacker | CyberScoop
Nine Arrested in €600M crypto laundering bust across Europe
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
Firms at risk as Japan struggles to keep up with cybercrime amid rise of ransomware - The Mainichi
US Refuses to Sign UN Cybercrime Treaty
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Operation Chargeback Uncovers €300m Fraud Scheme in 193 Countries - Infosecurity Magazine
18 arrested in €300 million global credit card fraud scheme - Help Net Security
Android Malware Mutes Alerts, Drains Crypto Wallets
Hacker steals over $120 million from Balancer DeFi crypto protocol
Nine Arrested in €600M crypto laundering bust across Europe
Google Threat Report Links AI-powered Malware to DPRK Crypto Theft - Decrypt
Insider Risk and Insider Threats
Employees keep finding new ways around company access controls - Help Net Security
Insurance
How Ransomware Attacks Leverage Cyber Insurance Policies - Security Boulevard
Is cyber on the verge of becoming uninsurable? | Insurance Business America
Supply Chain and Third Parties
Cybercrime To Hit Critical Supply Chains As AI Amplifies Global Risk, Google Warns | Scoop News
Chinese APT Uses 'Airstalk' Malware in Supply Chain Attacks - SecurityWeek
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
Washington Post says it is among victims of cyber breach tied to Oracle software | Reuters
Software dev accidentally leaks Australian govt documents | Information Age | ACS
Data breach at major Swedish software supplier impacts 1.5 million
Open VSX rotates access tokens used in supply-chain malware attack
Software Supply Chain
Cloud/SaaS
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries
Researchers Just Revealed 4 Big Microsoft Teams Vulnerabilities
With each cloud outage, calls for government action grow louder | CyberScoop
EU and UK organizations ponder resilience after Azure outage • The Register
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
UK accused of being too slow to regulate cloud services providers
Oracle’s cloud strategy an increasingly risky bet | CIO
Outages
EU and UK organizations ponder resilience after Azure outage • The Register
With each cloud outage, calls for government action grow louder | CyberScoop
Identity and Access Management
Employees keep finding new ways around company access controls - Help Net Security
Linux and Open Source
Russian hackers abuse Hyper-V to hide malware in Linux VMs
Ongoing Ransomware Attacks Exploit Linux Vulnerability, CISA Warns
International Criminal Court dumps Microsoft Office • The Register
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
Logging in as root on Linux? Here's why that disaster waiting to happen | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
The Louvre’s video surveillance had a shockingly weak password | Cybernews
Have I Been Pwned adds a billion new passwords to its database - gHacks Tech News
The Worst Password Of 2025 Is '123456' - Make Sure You Don't Use These
What are the most common passwords? No surprises here • The Register
Social Media
Cybercriminals have built a business on YouTube’s blind spots - Help Net Security
Malvertising
Beware - ransomware gang is tricking victims with fake Microsoft Teams ads | TechRadar
Weaponized Putty and Teams Ads Deliver Malware Allowing Hackers to Access Network
Training, Education and Awareness
What keeps phishing training from fading over time - Help Net Security
Study concludes cybersecurity training doesn’t work | KPBS Public Media
Regulations, Fines and Legislation
U.S. Sanctions 10 North Korean Entities for Laundering $12.7M in Crypto and IT Fraud
Report: 36% of companies do not know whether they are covered by NIS2 directive
Cyber Resilience Act: Overview for affected companies
With each cloud outage, calls for government action grow louder | CyberScoop
Connected devices may face mandatory security checks before you can use them
The US must not endorse Russia and China’s vision for cybersecurity
UK accused of being too slow to regulate cloud services providers
US Refuses to Sign UN Cybercrime Treaty
Trump admin begins developing new cybersecurity strategy
Senate approves new leader for Army Cyber Command - Breaking Defense
Old privacy laws create new risks for businesses - Help Net Security
Models, Frameworks and Standards
Report: 36% of companies do not know whether they are covered by NIS2 directive
Cyber Resilience Act: Overview for affected companies
Old privacy laws create new risks for businesses - Help Net Security
Data Protection
Old privacy laws create new risks for businesses - Help Net Security
Careers, Working in Cyber and Information Security
To maximize their influence, CISOs need diverse skills | TechTarget
Starting Over in Cybersecurity: Advice I Wish I'd Had
Law Enforcement Action and Take Downs
Operation Chargeback Uncovers €300m Fraud Scheme in 193 Countries - Infosecurity Magazine
Europe's phone networks are drowning in fake calls - Help Net Security
Backdoored ‘secure’ messaging app leads to more arrests • The Register
US cybersecurity experts indicted for BlackCat ransomware attacks
Nine Arrested in €600M crypto laundering bust across Europe
Court reimposes original sentence for Capital One hacker | CyberScoop
Ukrainian allegedly involved in Conti ransomware attacks faces up to 25 years in jail | CyberScoop
US Refuses to Sign UN Cybercrime Treaty
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Electronic Weapons: Russian Cyber War Against Germany
How nations build and defend their cyberspace capabilities - Help Net Security
Beyond Denial: Toward a Credible Cyber Deterrence Strategy • Stimson Center
Nation State Actors
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
Cyber Physical Systems Face Rising Geopolitical Risks
China
Cyber loot flows to Russia and its friends | Cybernews
The US must not endorse Russia and China’s vision for cybersecurity
Chinese APT Uses 'Airstalk' Malware in Supply Chain Attacks - SecurityWeek
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
Xi Jinping jokes about backdoors in Xiaomi smartphones • The Register
US Space Force to Use Three Weapons To Jam Chinese Satellites Via Remote Control - Bloomberg
Germany Weighs Paying Deutsche Telekom to Replace Huawei Gear - Bloomberg
Finland to Tighten Huawei Ban in 5G Network on Security Grounds - Bloomberg
China-linked hackers exploited Lanscope flaw as a zero-day in attacks
Russia
Britain ‘highly vulnerable’ to Russian cyber attacks, warns former Army chief
Cyber loot flows to Russia and its friends | Cybernews
Russian hackers hit Windows machines via Linux VMs with new custom malware | TechRadar
The US must not endorse Russia and China’s vision for cybersecurity
Electronic Weapons: Russian Cyber War Against Germany
The cottage industry quietly manipulating chatbots’ replies
Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine - Ars Technica
Russia Wages War On The Internet In Ukraine, But Resistance Is Winning
Ukraine’s Security Service repels over 2,300 enemy cyberattacks in 2025 - Freedom
Offensive Cyber Operations and Combat Effectiveness After Ukraine | Lawfare
NATO's Crossed Swords cyber exercise gets underway in Tallinn | News | ERR
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
Iran
UNK_SmudgedSerpent Targets Academics With Political Lures - Infosecurity Magazine
Iran's 'SmudgedSerpent APT Phishes US Policy Wonks
North Korea
Cyber loot flows to Russia and its friends | Cybernews
U.S. sanctioned North Korea bankers for laundering funds linked to cyberattacks and peapons program
Google Threat Report Links AI-powered Malware to DPRK Crypto Theft - Decrypt
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Nation-State, Cyber and Hacktivist Threats Pummel Europe
Hacktivist-Driven DDoS Dominates Attacks on Public Sector - Infosecurity Magazine
Tools and Controls
Old threats, new consequences: 90% of cyber claims stem from email and remote access | CSO Online
Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection
Russian hackers abuse Hyper-V to hide malware in Linux VMs
NATO's Crossed Swords cyber exercise gets underway in Tallinn | News | ERR
AI Becomes Both Tool and Target in Cybersecurity
Survey: Organizations Are Too Confident in Their Cyber Resiliency - Security Boulevard
Financial services can't shake security debt - Help Net Security
Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks
Russian hackers host secret VMs on Windows | Cybernews
EU and UK organizations ponder resilience after Azure outage • The Register
Enterprises are losing track of the devices inside their networks - Help Net Security
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities
Vibe coding security risks and how to mitigate them | IT Pro
The Next Evolution Of Cybersecurity Is Preemptive
Browser detection and response fills gaps in security programs | TechTarget
AI can flag the risk, but only humans can close the loop - Help Net Security
Reports Published in the Last Week
UK’s National Cyber Security Centre Releases 2025 Annual Review | Alston & Bird - JDSupra
Other News
Zombie Projects Rise Again to Undermine Security
Louvre delayed Windows security updates ahead of burglary – Computerworld
Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks
International Criminal Court dumps Microsoft Office • The Register
Europe's energy grid faces growing cyber threat • The Register
Europe eyes digital sovereignty sans big tech | TelecomTV
Shipping’s cyber reckoning - Splash247
Ofcom to Boost UK Telecoms Security by Working with Key Countries - ISPreview UK
How can we keep our society and economy cyber secure? - New Statesman
How nations build and defend their cyberspace capabilities - Help Net Security
Totally Exposed at 30,000 Feet - Center for Democracy and Technology
Scottish Government launches refreshed cyber strategy
Cyber Physical Systems Face Rising Geopolitical Risks
Hospitals are running out of excuses for weak cyber hygiene - Help Net Security
The race to defend satellites from cyberattacks - SpaceNews
The Rising Tide of Cyber-Attacks Against the UK Water Sector | Fortra
Vulnerability Management
Zombie Projects Rise Again to Undermine Security
Louvre delayed Windows security updates ahead of burglary | CSO Online
UK dept spent £312M moving to Win 10 as support D-day hits • The Register
SolarWinds-Like Risk Lurks in Popular Installer Tool
Vulnerabilities
Researchers Just Revealed 4 Big Microsoft Teams Vulnerabilities
Update Chrome now: 20 security fixes just landed | Malwarebytes
Two Windows vulnerabilities, one a 0-day, are under active exploitation - Ars Technica
New Attack Combines Ghost SPNs and Kerberos Reflection to Elevate Privileges on SMB Servers
Cisco Warns of Hackers Actively Exploiting ASA and FTD 0-day RCE Vulnerability in the Wild
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
Australia warns of BadCandy infections on unpatched Cisco devices
Windows Graphics Vulnerabilities Allow Remote Attackers to Execute Arbitrary Code
New GDI Flaws Could Enable Remote Code Execution in Windows - Infosecurity Magazine
Android Update Patches Critical Remote Code Execution Flaw - SecurityWeek
Apple Patches Multiple Critical Vulnerabilities in iOS 26.1 and iPadOS 26.1
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362
SolarWinds-Like Risk Lurks in Popular Installer Tool
Ongoing Ransomware Attacks Exploit Linux Vulnerability, CISA Warns
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data
Claude Desktop Extensions Vulnerable to Web-Based Prompt Injection - Infosecurity Magazine
Hackers exploit critical auth bypass flaw in JobMonster WordPress theme
Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching
Critical UniFi OS Vulnerability Enables Remote Code Execution Attacks
Microsoft: October Windows updates trigger BitLocker recovery
AMD confirms some Zen 5 CPUs have a worrying security flaw that could put users at risk | TechRadar
Exploited 'Post SMTP' Plugin Flaw Exposes WordPress Sites to Takeover - SecurityWeek
China-linked hackers exploited Lanscope flaw as a zero-day in attacks
Hackers exploit WordPress plugin Post SMTP to hijack admin accounts
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 31 October 2025
Black Arrow Cyber Threat Intelligence Briefing 31 October 2025:
-Ransomware Recovery Perils: 40% of Paying Victims Still Lose Their Data
-Reacting Slowly to a Security Breach Opens up Your Business to More Threats, Report Warns
-SMEs Unprepared to Defend Against Advanced Cyber Threats
-UK Financial Regulator to Focus on Cyber Defence
-The 10 Biggest Issues CISOs and Cyber Teams Face Today
-The Cyber Security Perception Gap: Why Executives and Practitioners See Security Differently
-Shadow AI: One In Four Employees Use Unapproved AI Tools, Research Finds
-LinkedIn Phishing Targets Finance Execs With Fake Board Invites
-Social Engineering: Why the ClickFix Malware Attack Just Won’t Go Away
-New Phishing Attack Using Invisible Characters Hidden in Subject Line
-BT Warns of Soaring Cyber Threats Targeting UK Firms
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week, ransomware continues to underline the need for leaders to plan to prevent attacks and manage them effectively if the worst happens, with 40% of paying victims still unable to recover their data. SMEs face rising exposure as cyber criminals exploit weaker controls and limited recovery planning, showing that every organisation must understand its risk profile and response capability.
We see the UK financial regulator strengthening its stance on operational resilience, signalling growing expectations for leadership accountability. Business leaders are reassessing their exposure and security, but with a clear need to ensure perceptions of security reflect reality. Current threats include shadow AI, LinkedIn campaigns targeting executives, persistent malware, advanced phishing, and attackers constantly scanning potential victims for exploitable weaknesses.
These developments reinforce that resilience includes building security and preparing to manage an incident. Contact us to discuss how we help achieve this, including through impartial incident-response simulations that help leaders rehearse and objectively challenge their preparedness.
Top Cyber Stories of the Last Week
Ransomware Recovery Perils: 40% of Paying Victims Still Lose Their Data
A Hiscox survey of SMEs found that two in five organisations that pay ransoms still fail to recover their data. Ransomware attacks remain widespread, with 27% of firms hit in the past year and 80% paying in hopes of restoration. Experts say recovery often fails due to flawed encryption, corrupted backups and untested recovery plans. Paying rarely resolves the full breach, which may include data theft or GDPR implications. Strong preparation, tested backups, insurance and legal readiness are key to resilience.
Reacting Slowly to a Security Breach Opens up Your Business to More Threats, Report Warns
Barracuda’s latest research finds most organisations suffered at least one email breach in the past year and slow response hugely increases follow-on risk. The report links delayed containment with higher odds of ransomware and material business disruption, including reputational harm and lost opportunities. Small firms are hit hard as recovery costs scale per employee and teams struggle to detect and triage incidents within an hour. The authors call for quicker detection, automation in response and a unified approach to break entire attack chains rather than point-in-time fixes.
SMEs Unprepared to Defend Against Advanced Cyber Threats
Vodafone’s latest report warns that Irish SMEs are struggling to keep pace with AI-driven cyber threats. One in four firms could collapse after a single ransomware attack, and AI-powered scams are expected to drive a 50% rise in attack costs within three years. Only half of SMEs rank cyber security as a top priority, while 69% lack proper safeguards. With attackers cloning voices and creating adaptive malware, Vodafone urges practical defences such as training, multi-factor authentication and partnerships with expert providers.
Source: https://www.techcentral.ie/smes-unprepared-to-defend-against-advanced-cyber-threats/
UK Financial Regulator to Focus on Cyber Defence
The Financial Conduct Authority (FCA) signalled a sharper focus on cyber defence and technology as part of its role in safeguarding national security. Speaking to City leaders, chief executive Nikhil Rathi argued that modern conflict hits balance sheets and markets as much as battlefields, and that the regulator must adapt accordingly. The speech pointed to bolstering operational resilience, tackling systemic tech risks and ensuring boards treat cyber as a strategic threat. Firms should expect closer scrutiny of preparedness and clearer expectations for governance, detection and recovery.
The 10 Biggest Issues CISOs and Cyber Teams Face Today
This piece outlines the pressures security leaders say are hardest right now. Priorities include securing AI infrastructure and data, simplifying sprawling toolsets, addressing talent burnout and budget constraints, and improving basic hygiene while preparing for high-impact incidents. The article stresses that AI use is outpacing guardrails, that misaligned incentives impede progress, and that boards seek clearer metrics tied to business outcomes. Leaders are urged to invest in automation, uplift human factors and embed cyber risk into enterprise decision making with repeatable reporting that executives can act on.
The Cyber Security Perception Gap: Why Executives and Practitioners See Security Differently
The article highlights a widening gap between executive confidence and practitioner reality. Frontline teams report tool complexity, alert fatigue and skills shortages, while leaders assume capabilities are stronger and incidents rarer than they are. The author says this misalignment leads to underfunded controls and delayed responses. Recommendations include rationalising tools, automating routine tasks and establishing common risk language and measures that map to resilience outcomes. Greater transparency on near misses and recovery times is urged so investment tracks real exposure rather than assumed maturity.
Source: https://thehackernews.com/2025/10/the-cybersecurity-perception-gap-why.html
Shadow AI: One In Four Employees Use Unapproved AI Tools, Research Finds
A 1Password report found that 27% of employees use AI tools not approved by their organisation, making shadow AI the second most common form of shadow IT after email. While 73% of workers say their company supports AI use, many bypass policies for convenience or productivity. Risks include data leakage, compliance breaches and malware. The report urges firms to maintain an AI tool inventory, define clear usage policies and limit access to authorised platforms to manage accumulated exposure risks.
Source: https://www.infosecurity-magazine.com/news/shadow-ai-employees-use-unapproved/
LinkedIn Phishing Targets Finance Execs With Fake Board Invites
A phishing campaign on LinkedIn is targeting finance executives with fake invitations to join an investment fund. Messages link to malicious sites that mimic LinkedIn and Microsoft login pages, stealing credentials and session cookies through an adversary-in-the-middle setup. Push Security reports that 34% of phishing attempts now occur outside email, up from under 10% three months ago. Attackers use CAPTCHA and Cloudflare Turnstile to evade scanners. Experts urge executives to verify unexpected LinkedIn messages and avoid clicking shared links.
Social Engineering: Why the ClickFix Malware Attack Just Won’t Go Away
ClickFix remains stubborn because it persuades users to perform the risky action themselves, sidestepping many built-in protections. The article explains how browser prompts trick victims into copying and running commands that fetch malware, and describes FileFix as a related variant that uses File Explorer to trigger the same outcome. As the user initiates execution, technical controls may not trigger, so layered mitigations and user awareness are emphasised. The piece encourages stricter browser security policies and training that flags unusual copy-paste and command execution patterns.
Source: https://www.makeuseof.com/why-clickfix-malware-attack-just-wont-go-away/
New Phishing Attack Using Invisible Characters Hidden in Subject Line
Researchers observed attackers inserting invisible characters into email subject lines that bypass automated filters while appearing normal to users. The technique mixes MIME encoding and Unicode soft hyphens so keyword-based systems miss risky terms. It underscores how social engineering adapts when controls focus on predictable patterns. The article advises updating filter logic to normalise subject strings, strengthening multi-factor authentication, and coaching staff to treat odd formatting as a red flag. It also highlights the need to monitor for anomalies in the way messages appear in different email applications.
Source: https://cybersecuritynews.com/new-phishing-attack-using-invisible-characters/
BT Warns of Soaring Cyber Threats Targeting UK Firms
BT reported a 300% surge in cyber surveillance, with UK businesses now scanned over 4,000 times daily for vulnerabilities. Professional services, retail, and hospitality sectors face the most ransomware activity, with smaller firms hardest hit. BT urges proactive measures to strengthen cyber resilience.
Source: https://www.lawnews.co.uk/cyber/bt-warns-of-soaring-cyber-threats/
Governance, Risk and Compliance
UK financial regulator to focus on cyber defence - UKTN
Enterprises can’t keep a lid on surging cyber incident costs | IT Pro
The Cybersecurity Perception Gap: Why Executives and Practitioners See Risk Differently
CISOs Finally Get a Seat at the Board's Table
BSI Warns of Looming AI Governance Crisis - Infosecurity Magazine
LinkedIn phishing targets finance execs with fake board invites
BT Data Reveals 300% Rise in Cyber Surveillance on Businesses
UK businesses scanned 4000 times a day by hackers - Insurance Post
SMEs unprepared to defend against advanced cyber threats - TechCentral.ie
CFOs Double Down on AI and Cybersecurity as Tariffs Emerge as Major New Threat
Do CISOs need to rethink service provider risk? | CSO Online
The Cybersecurity Shift Every Business Needs to Make Today
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Cyber and AI Oversight Disclosures: What Companies Shared in 2025
70% of CISOs say internal conflicts more damaging than cyberattacks | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware recovery perils: 40% of paying victims still lose their data | CSO Online
Insider Threats Loom while Ransom Payment Rates Plummet - Security Boulevard
QBE predicts 40% rise in ransomware incidents by 2026 | Insurance Times
1 in 4 SMEs face ransomware risk - Shelflife Magazine
New LockBit Ransomware Victims Identified by Security Researchers - Infosecurity Magazine
Why Britain is struggling to stop the ransomware cyberattacks | The Week
Qilin Ransomware Group Publishes Over 40 Cases Monthly - Infosecurity Magazine
Why ransomware group names don’t matter for defense | SC Media
Three Factors Determine Whether a Ransomware Group is Successful - Security Boulevard
Ransomware Hackers Look for New Tactics Amid Falling Profits
Ransomware hackers are now running Linux encryptors in Windows to stay undetected | TechRadar
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc
Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks
Cisco, Citrix and SonicWall VPNs connected to higher risk of ransomware infections | TechRadar
Uncovering Qilin attack methods exposed through multiple cases
Surprised, Not Surprised, Ransomware Attacks Have Ticked Up - Security Boulevard
28% of Irish businesses risk closure with one ransomware attack
Pulling the plug: A way to halt a cyber attacker in your network? | Computer Weekly
Next-gen firewalls, VPNs can increase security risks: At-Bay • The Register
180 ransomware attacks plague education sector worldwide in 2025 through Q3 | K-12 Dive
Ransomware Victims
The costliest cyber attack in UK history | PQ Magazine
New LockBit Ransomware Victims Identified by Security Researchers - Infosecurity Magazine
Russian hackers threaten Dublin Airport | Cybernews
More Collins Aerospace Hacking Fallout - InfoRiskToday
TCS denies losing UK’s Marks & Spencer contract over £300 million cyberattack - The Economic Times
Qilin claims pharmacy benefit manager MedImpact | Cybernews
Ransomware gang claims Conduent breach: what you should watch for next | Malwarebytes
Phishing & Email Based Attacks
LinkedIn phishing targets finance execs with fake board invites
New Phishing Attack Bypasses Using UUIDs Unique to Bypass Secure Email Gateways
New CoPhish attack steals OAuth tokens via Copilot Studio agents
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Fake LastPass death claims used to breach password vaults
How we linked ForumTroll APT to Dante spyware by Memento Labs | Securelist
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
KnowBe4 Uncovers Surged Abuse of Legitimate Platforms by Cybercriminals in 2025
Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation
9 in 10 Exchange servers in Germany are out of support • The Register
ClickFix Infrastructure Surprises Inform Better Blocking
Google disputes false claims of massive Gmail data breach
Other Social Engineering
LinkedIn phishing targets finance execs with fake board invites
This new malware attack just wont go away
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Fake LastPass death claims used to breach password vaults
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation
Hackers Use AI to Supercharge Social Engineering Attacks
ClickFix Infrastructure Surprises Inform Better Blocking
BiDi Swap: The bidirectional text trick that makes fake URLs look real
Google study finds Android avoids 58% more spam and scam texts compared to iOS
ICO fines sole trader for allegedly sending 1M spam texts • The Register
Fraud, Scams and Financial Crime
UK Fraud Cases Surge 17% Annually - Infosecurity Magazine
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
A Quarter of Scam Victims Have Considered Self-Harm - Infosecurity Magazine
Google study finds Android avoids 58% more spam and scam texts compared to iOS
Investment Scams Spread Across Asia With International Reach - Infosecurity Magazine
Artificial Intelligence
New CoPhish attack steals OAuth tokens via Copilot Studio agents
BSI Warns of Looming AI Governance Crisis - Infosecurity Magazine
AI browsers are the next big target for hackers - Cryptopolitan
AI chatbots are sliding toward a privacy crisis - Help Net Security
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Hackers Use AI to Supercharge Social Engineering Attacks
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc
Are AI browsers worth the security risk? Why experts are worried | ZDNET
Dark AI is fueling cybercrime — and accelerating the cybersecurity arms race - Big Think
AI writes code like a junior dev, and security is feeling it - Help Net Security
AI agents can leak company data through simple web searches - Help Net Security
Chatbots parrot Putin propaganda about Ukraine invasion • The Register
Your photo could be all AI needs to clone your voice - Help Net Security
One In Four Employees Use Unapproved AI Tools, Research Finds - Infosecurity Magazine
Get your news from AI? Watch out - it's wrong almost half the time | ZDNET
AI Search Tools Easily Fooled by Fake Content
First Zero Click Attack Exploits MCP and Connected Popular AI Agents To Exfiltrate Data Silently
One week to opt out or be fodder for LinkedIn AI training • The Register
2FA/MFA
X: Re-enroll 2FA security keys by November 10 or get locked out
Malware
This new malware attack just wont go away
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
Infostealers Run Wild - DataBreachToday
Hackers steal Discord accounts with RedTiger-based infostealer
Hackers weaponize Telegram messenger with malware to gain system control - Cryptopolitan
Malicious NPM packages fetch infostealer for Windows, Linux, macOS
PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs
Defenses Need to Adapt, Because the Malware Already Did
DDoS, data theft, and malware are storming the gaming industry - Help Net Security
Bots/Botnets
Botnets Step Up Cloud Attacks Via Flaws, Misconfigs
Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices
Mobile
Android malware uses random text delays to look more human • The Register
Massive surge of NFC relay malware steals Europeans’ credit cards
Hackers weaponize Telegram messenger with malware to gain system control - Cryptopolitan
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
Google study finds Android avoids 58% more spam and scam texts compared to iOS
MPs urge UK government to stop phone theft wave through tech • The Register
Why the 5G symbol on your phone doesn't mean you actually have 5G - BBC News
Denial of Service/DoS/DDoS
Security hole slams Chromium browsers - no fix yet • The Register
DDoS, data theft, and malware are storming the gaming industry - Help Net Security
Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed
Internet of Things – IoT
Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices
How neighbors could spy on smart homes - Help Net Security
Data Breaches/Leaks
Infamous Cybercriminal Forum BreachForums Is Back Again With A New Clear Net Domain
List of Oracle EBS Attack Victims May Be Growing Longer
EY exposed 4TB SQL backup file to open web, researchers say • The Register
Hackers steal Discord accounts with RedTiger-based infostealer
F5 asserts limited impact from prolonged nation-state attack on its systems | CyberScoop
Hackers Allegedly Claim Breach Of HSBC USA Customers' Records Including Financial Details
Human impact of UK's Afghan data disaster revealed to MPs • The Register
When 183 Million Passwords Leak: How One Breach Fuels a Global Threat Chain - Security Boulevard
Email breaches are the silent killers of business growth - Help Net Security
First Zero Click Attack Exploits MCP and Connected Popular AI Agents To Exfiltrate Data Silently
Ransomware gang claims Conduent breach: what you should watch for next | Malwarebytes
What to Do About the Massive Gmail Password Data Leak
Marketing giant Dentsu warns staff after Merkle data raid • The Register
Hackers steal data of fashion retailer Mango’s customers • Graham Cluley
DDoS, data theft, and malware are storming the gaming industry - Help Net Security
Iran’s MOIS-linked Ravin Academy hit by data breach • The Register
UK lotto players land data jackpot thanks to website error • The Register
Organised Crime & Criminal Actors
Infamous Cybercriminal Forum BreachForums Is Back Again With A New Clear Net Domain
UK Fraud Cases Surge 17% Annually - Infosecurity Magazine
Insider Threats Loom while Ransom Payment Rates Plummet - Security Boulevard
72 states sign first global UN Convention against Cybercrime - Help Net Security
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
Two U.K. teenagers appear in court over Transport of London cyber attack – DataBreaches.Net
UN Cybercrime Treaty wins dozens of signatories • The Register
Insider Risk and Insider Threats
Insider Threats Loom while Ransom Payment Rates Plummet - Security Boulevard
Insider Threat Prevention - Security Boulevard
Data on Insider Threats Reveal Hidden Risk Patterns
Insurance
Cyber insurance demand rises as global tensions fuel surge in digital threats - BetaNews
New threats spike cyber insurance surge
Supply Chain and Third Parties
Do CISOs need to rethink service provider risk? | CSO Online
NYSDFS Guidance on Managing Risks to Third-Party Service Provider
Google Investigates Weekslong Security Breach Involving Contractor — The Information
UK leads global fight to stop ransomware attacks on supply chains - GOV.UK
Cloud/SaaS
Botnets Step Up Cloud Attacks Via Flaws, Misconfigs
Microsoft: DNS outage impacts Azure and Microsoft 365 services
What to Do About the Massive Gmail Password Data Leak
Germany issues hacked account checklist | Cybernews
Microsoft sued for allegedly tricking millions into Copilot M365 subscriptions
Microsoft Security Change for Azure Creates Pitfalls
Outages
Microsoft: DNS outage impacts Azure and Microsoft 365 services
Identity and Access Management
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Encryption
Chrome to Make HTTPS Mandatory by Default in 2026 - Infosecurity Magazine
Linux and Open Source
Ransomware hackers are now running Linux encryptors in Windows to stay undetected | TechRadar
Ubuntu’s Kernel Vulnerability Let Attackers Escalate Privileges and Gain Root Access
Ultimate Guide to Open Source Security: Risks, Attacks & Defenses - Security Boulevard
Why open source may not survive the rise of generative AI | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
When 183 Million Passwords Leak: How One Breach Fuels a Global Threat Chain - Security Boulevard
Cybercriminals Trade 183 Million Stolen Credentials on Telegram, Dark Forums - SecurityWeek
Social Media
LinkedIn phishing targets finance execs with fake board invites
Germany issues hacked account checklist | Cybernews
X: Re-enroll 2FA security keys by November 10 or get locked out
One week to opt out or be fodder for LinkedIn AI training • The Register
Regulations, Fines and Legislation
UK financial regulator to focus on cyber defence - UKTN
Government Shutdown Creates Lapse in Cyber Threat Information Sharing | Alston & Bird - JDSupra
Shutdown Sparks 85% Increase in US Gov't Cyberattacks
US cybersecurity progress is 'slipping,' report warns | American Banker
72 states sign first global UN Convention against Cybercrime - Help Net Security
UN Cybercrime Treaty wins dozens of signatories • The Register
Navigating EMEA Regulatory Compliance for Critical Infrastructure | IT Pro
Navigating NIS2: What Organisations Need to Know as EU Implementation Unfolds | Goodwin - JDSupra
ICO fines sole trader for allegedly sending 1M spam texts • The Register
New York’s Cyber Rules Ramp Up Pressure on Security Officers
Models, Frameworks and Standards
Navigating NIS2: What Organisations Need to Know as EU Implementation Unfolds | Goodwin - JDSupra
Careers, Working in Cyber and Information Security
Cyber Pros Needed: Securing the Middle Ground
Cross-border cooperation can help to tackle global cyber talent shortage
Top tips to prepare for a cybersecurity job interview
Law Enforcement Action and Take Downs
Infamous Cybercriminal Forum BreachForums Is Back Again With A New Clear Net Domain
Two U.K. teenagers appear in court over Transport of London cyber attack – DataBreaches.Net
72 states sign first global UN Convention against Cybercrime - Help Net Security
UN Cybercrime Treaty wins dozens of signatories • The Register
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
Ex-US cyber intel exec pleads guilty to selling spy tools to Russian broker | Reuters
Misinformation, Disinformation and Propaganda
Chatbots parrot Putin propaganda about Ukraine invasion • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
How China really spies on the UK in 2025 - BBC News
‘I am not a robot’: Russian hackers use fake CAPTCHA lures to deploy espionage tools | CSO Online
Shifting from reactive to proactive: Cyber resilience amid nation-state espionage | CyberScoop
Suspected Chinese snoops weaponize unpatched Windows flaw • The Register
Nation State Actors
China
How China really spies on the UK in 2025 - BBC News
F5 asserts limited impact from prolonged nation-state attack on its systems | CyberScoop
CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Suspected Chinese snoops weaponize unpatched Windows flaw • The Register
Britain Needs China’s Money. It Fears What Comes With It. - The New York Times
US company with access to biggest telecom firms uncovers breach by nation-state hackers | Reuters
China-linked hackers exploit patched ToolShell flaw to breach Middle East telecom
US Government Urges Total Ban of Our Most Popular Wi-Fi Router - CNET
Russia
‘I am not a robot’: Russian hackers use fake CAPTCHA lures to deploy espionage tools | CSO Online
Sanctions won’t stop cyberattacks, but they can still "bite" - Help Net Security
Chatbots parrot Putin propaganda about Ukraine invasion • The Register
Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks
Nation-State Cyber Ecosystems Weakened by Sanctions, Report Reveals - Infosecurity Magazine
Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets
Ex-US cyber intel exec pleads guilty to selling spy tools to Russian broker | Reuters
NBC Weapons: Russia Resorts to Chemical Warfare
Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed
Iran
Iran’s MOIS-linked Ravin Academy hit by data breach • The Register
North Korea
North Korean Hackers Attacking Unmanned Aerial Vehicle Industry to Steal Confidential Data
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign
SideWinder Hacking Group Uses ClickOnce-Based Infection Chain to Deploy StealerBot Malware
How we linked ForumTroll APT to Dante spyware by Memento Labs | Securelist
Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware
Tools and Controls
AI browsers are the next big target for hackers - Cryptopolitan
AI writes code like a junior dev, and security is feeling it - Help Net Security
Shifting from reactive to proactive: Cyber resilience amid nation-state espionage | CyberScoop
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Cyber insurance demand rises as global tensions fuel surge in digital threats - BetaNews
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Are AI browsers worth the security risk? Why experts are worried | ZDNET
AI browsers are a cybersecurity time bomb | The Verge
Cisco, Citrix and SonicWall VPNs connected to higher risk of ransomware infections | TechRadar
CFOs Double Down on AI and Cybersecurity as Tariffs Emerge as Major New Threat
Digital Risk Management Strategies
Why Early Threat Detection Is a Must for Long-Term Business Growth
The State of Exposure Management in 2025: Insights From 3,000+ Organizations
NYSDFS Guidance on Managing Risks to Third-Party Service Provider
Pulling the plug: A way to halt a cyber attacker in your network? | Computer Weekly
Next-gen firewalls, VPNs can increase security risks: At-Bay • The Register
Mozilla: New Firefox extensions must disclose data collection practices
CISA and NSA share tips on securing Microsoft Exchange servers
US Government Urges Total Ban of Our Most Popular Wi-Fi Router - CNET
Vulnerability Management
The State of Exposure Management in 2025: Insights From 3,000+ Organizations
Ultimate Guide to Open Source Security: Risks, Attacks & Defenses - Security Boulevard
9 in 10 Exchange servers in Germany are out of support • The Register
NHS quarantines devices as suppliers drag feet on Windows 11 • The Register
Vulnerabilities
List of Oracle EBS Attack Victims May Be Growing Longer
Microsoft Issues Emergency Patch for Windows Server Bug
CVE-2025-59287: Microsoft fixes critical WSUS flaw under active attack
Microsoft WSUS attacks hit 'multiple' orgs, Google warns • The Register
CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Suspected Chinese snoops weaponize unpatched Windows flaw • The Register
Ubuntu’s Kernel Vulnerability Let Attackers Escalate Privileges and Gain Root Access
Multiple Oracle VM VirtualBox Vulnerabilities Enables Complete Takeover Of VirtualBox
Year-Old WordPress Plugin Flaws Exploited to Hack Websites - SecurityWeek
Apache Tomcat Security Vulnerabilities Expose Servers to Remote Code Execution Attacks
OpenVPN Vulnerability Exposes Linux, MacOS Systems To Script Injection Attacks
New "Brash" Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL
Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware
Security hole slams Chromium browsers - no fix yet • The Register
Chrome 0-Day Vulnerability Actively Exploited in Attacks by Notorious Hacker Group
QNAP warns of critical ASP.NET flaw in its Windows backup software
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 24 October 2025
Black Arrow Cyber Threat Intelligence Briefing 24 October 2025:
-GCHQ Says Boards Must Understand Cyber Risks and Prepare for Attacks That Get Through
-Study Reveals Cyber Confidence Often Misaligned with Reality
-Threat Actors Exploiting Faster Than Businesses Can Respond
-Millions Still Use One Password Across Multiple Accounts
-Microsoft Warns of Sharp Rise in Identity Attacks Driven by Password Theft
-Insider Risks Cause Data Loss in 77% of Organisations
-AI-Driven Threats Are Top Concern for Cyber Professionals in 2026
-Infostealers Are Reshaping the Cyber Security Landscape
-How ClickFix Attackers Trick You to Attack Yourself and Bypass Your Security
-Business Confidence in Ransomware Defence Is High, But Readiness Is Low
-Ransomware Payouts Surge to $36M in Recent Cases
-Third-Party Breaches Escalate as Confidence Gap Widens Among Cyber Leaders
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week, the head of GCHQ has urged businesses to ensure their boards include members who understand cyber risks and can ask the right questions, while a new report highlights that many organisations are misaligned in their perception of cyber security strength versus actual security.
We also include a reminder about one of the most basic cyber controls: passwords. Millions of users have a single password for multiple accounts, and Microsoft warns of a rise in attacks driven by password theft. Our other insights include attackers exploiting vulnerabilities within days and using AI to scale their impact, the rising threat of ransomware, and the broader consequences of business leaders not recognising the gaps in their defences including the importance of testing incident response plans.
Responding to the above GCHQ call to action, contact us to learn how we support our client boards in their cyber governance and compliance. We join regular board meetings to lead the conversation on progress in building stronger and proportionate cyber security, while upskilling board members to support continuous development.
Top Cyber Stories of the Last Week
GCHQ Says Boards Must Understand Cyber Risks and Prepare for Attacks That Get Through
The head of GCHQ has urged UK companies to prepare for inevitable cyber-attacks by developing contingency plans that include offline crisis protocols. Speaking at a cyber security conference, Anne Keast-Butler stressed that boards must include members who understand cyber risks and can ask the right questions. She highlighted the increasing frequency of significant attacks and the role of AI in lowering the barrier for malicious actors. The National Cyber Security Centre reported a sharp rise in major incidents, and underscored the need for rehearsed response strategies by leadership teams.
Source: https://www.theguardian.com/technology/2025/oct/23/gchq-companies-cyber-crime-threat
Study Reveals Cyber Confidence Often Misaligned with Reality
A new report highlights a gap between perceived cyber security strength and actual readiness. Many organisations believe they are well protected, yet lack basic controls such as multi-factor authentication and incident response testing. The analysis shows that overconfidence can lead to underinvestment in critical areas. Experts urge boards to validate their assumptions through independent assessments and to ensure that cyber security is governed like other enterprise risks. The findings reinforce the need for leadership accountability and continuous improvement.
Source: https://professionalsecurity.co.uk/products/cyber/confidence-and-reality/
Threat Actors Exploiting Faster Than Businesses Can Respond
Threat actors are now exploiting vulnerabilities within days of discovery, leaving businesses with little time to react. The article outlines how attackers use automation and AI to identify and weaponise weaknesses rapidly. Business leaders are urged to shorten patch cycles, improve threat intelligence sharing, and rehearse incident response. The piece emphasises that cyber resilience is no longer just a technical issue but a leadership challenge requiring proactive governance and investment in agility.
Millions Still Use One Password Across Multiple Accounts
A new study reveals that millions of users continue to rely on a single password for multiple accounts, despite years of awareness campaigns. The report finds that 31% of respondents reuse passwords across work and personal platforms, creating major risks for credential stuffing and account takeover. The article calls for stronger enforcement of password policies and wider adoption of password managers. It also highlights the need for leadership to model good behaviour and ensure staff receive regular training.
Source: https://cybernews.com/security/millions-use-one-password/
Microsoft Warns of Sharp Rise in Identity Attacks Driven by Password Theft
Microsoft has reported a 32% increase in identity-based cyber attacks in the first half of 2025, with over 97% involving password-based methods. According to its latest Digital Defense Report, attackers are increasingly using stolen credentials to impersonate employees or contractors, often leading to data theft and ransomware deployment. Infostealer malware and help desk scams are key tactics, with groups like Scattered Spider exploiting these methods. Microsoft also highlighted its efforts to disrupt threats such as Lumma Stealer and cracked Cobalt Strike tools. IT firms and government bodies remain top targets, while ransomware actors are increasingly abusing antivirus exclusions to bypass defences.
Source: https://therecord.media/microsoft-warns-of-surge-identity-hacks-passwords
Insider Risks Cause Data Loss in 77% of Organisations
A study finds that 77% of organisations have experienced data loss due to insider risks, including negligent or malicious behaviour. Security leaders cite lack of visibility and poor access controls as key contributors. The report stresses the importance of behavioural monitoring, role-based access, and staff awareness programmes. Insider threats are often overlooked compared to external attacks, yet they pose significant operational and reputational risks. Boards are advised to treat insider risk as a strategic issue requiring cross-functional governance.
AI-Driven Threats Are Top Concern for Cyber Professionals in 2026
New research from ISACA finds that AI-driven threats are the biggest concern for cyber security professionals heading into 2026. The survey reveals that 62% of respondents expect AI to increase the volume and sophistication of attacks. Concerns include deepfakes, automated phishing, and AI-powered malware. The report also notes a gap in preparedness, with only 38% of organisations confident in their ability to defend against AI-enabled threats. The findings call for urgent investment in AI-aware defences and leadership engagement on emerging risks.
Infostealers Are Reshaping the Cyber Security Landscape
Infostealers are a type of malware designed to silently collect credentials, session tokens and sensitive data from infected devices. These tools are increasingly used by attackers to bypass multi-factor authentication and gain persistent access to cloud services. Unlike ransomware, infostealers operate quietly, often going undetected while harvesting data for later use or sale. The rise of malware-as-a-service has made infostealers widely accessible, with criminal groups offering subscription models. Experts urge organisations to monitor for unusual login patterns and to implement stronger endpoint protection. The trend reflects a shift from disruptive attacks to silent data theft.
Source: https://betanews.com/2025/10/22/how-infostealers-have-changed-the-cybersecurity-landscape/
How ClickFix Attackers Trick You to Attack Yourself and Bypass Your Security
ClickFix is an attack method that pretends to be a fix for a broken page or a CAPTCHA, but in reality tricks users into copying and pasting malicious code from their browser clipboard. These attacks bypass email filters and rely on SEO poisoning and malvertising to lure victims. SEO poisoning involves attackers manipulating search engine results so that malicious websites appear high in search rankings, often mimicking legitimate help pages or software fixes. Once executed, the code runs locally and often evades endpoint detection. ClickFix has been linked to ransomware groups and state actors, with recent incidents affecting healthcare and municipal systems. The attack uses obfuscated JavaScript and legitimate-looking sites, making detection difficult.
Source: https://www.thehackernews.com/2025/10/analysing-clickfix-3-reasons-why.html
Business Confidence in Ransomware Defence Is High, But Readiness Is Low
A report finds a disconnect between business confidence and actual preparedness for ransomware attacks. While 70% of executives believe their organisations are well protected, only 35% have tested incident response plans. The report shows that attackers are evolving faster than defences, with double extortion and data theft now common tactics. The findings suggest that leadership needs to challenge its own evaluation and invest in practical resilience measures, including tabletop exercises and supplier coordination.
Ransomware Payouts Surge to $36M in Recent Cases
New data shows that ransomware payouts have surged, with recent cases totalling $36M. Attackers use double extortion tactics, demanding payment not only to decrypt data but also to prevent public exposure. The report highlights that many victims are SMEs with limited recovery options. Experts warn that paying ransoms often leads to further demands and does not guarantee full restoration. The findings support calls for stronger backup strategies and rehearsals of how to manage being attacked.
Source: https://www.infosecurity-magazine.com/news/ransomware-payouts-surge-dollar36m/
Third-Party Breaches Escalate as Confidence Gap Widens Among Cyber Leaders
Experts warn that third-party and supply chain breaches are spiralling out of control, with 60% of UK and US leaders admitting the risks are too complex to manage. Despite 97% expressing confidence in breach response, 61% reported suffering a third-party attack in the past year. The IO State of Information Security Report highlights incidents such as those at Jaguar Land Rover and Collins Aerospace, showing how supply chain compromise can cause widespread disruption. Smaller firms are increasingly targeted, yet only 23% of leaders ranked supply chain compromise among their top emerging threats.
Source: https://www.emergingrisks.co.uk/third-party-breaches-out-of-control-experts-warn/
Governance, Risk and Compliance
"We Are Very Exposed": Does The UK Need A New Plan For Cyber-Attacks?
Cyber security is business survival - NCSC.GOV.UK
Confidence and reality | Professional Security Magazine
2025 Cyber Incident Trends: What Your Business Needs to Know | Mayer Brown - JDSupra
Why Political Risk Is Now A Top Threat For Companies
62% of Risk Leaders Say Trade Wars Could Trigger Cyberattacks, New Riskonnect Research Finds
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Payouts Surge to $3.6m Amid Evolving Tactics - Infosecurity Magazine
Ransomware Reality: Business Confidence Is High, Preparedness Is Low
Scattered Lapsus$ Hunters Signal Shift in Tactics - Infosecurity Magazine
Madman Theory Spurs Crazy Scattered Lapsus$ Hunters Playbook
Warlock Ransomware: Old Actor, New Tricks? | SECURITY.COM
Japanese companies brace themselves for more attacks as cybercrimes climb | The Straits Times
Ransomware Victims
JLR hack 'is costliest cyber attack in UK history', experts say - BBC News
Jaguar Land Rover cyberattack could cost the UK almost £2B • The Register
UK Ministry of Defense Probes Military Contractor Data Leak
UK vehicle output drops by 36% following JLR cyber attack | Autocar
Japanese retailer Muji halted online sales after a ransomware attack on logistics partner
Golfwear giant allegedly targeted by Russian hackers | Cybernews
Phishing & Email Based Attacks
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches
This new cyberattack tricks you into hacking yourself. Here's how to spot it | ZDNET
How AI is driving email phishing and how to beat the threat [Q&A] - BetaNews
Many IT leaders click phishing links — and some don’t report them | CIO Dive
New Phishing Attack Leverages Azure Blob Storage to Impersonate Microsoft
TikTok videos continue to push infostealers in ClickFix attacks
John Bolton charged over classified emails after Iranian hack of his AOL account
PhantomCaptcha ClickFix attack targets Ukraine war relief orgs
New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs
Other Social Engineering
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches
AI Social Engineering Top Cyber Threat for 2026, ISACA Survey Reveals - Infosecurity Magazine
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Google and Check Point nuke massive YouTube malware network • The Register
Researchers track surge in high-level Smishing Triad activity | CyberScoop
TikTok videos continue to push infostealers in ClickFix attacks
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
Fraud, Scams and Financial Crime
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Google and Check Point nuke massive YouTube malware network • The Register
Researchers track surge in high-level Smishing Triad activity | CyberScoop
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide
131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign
Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People - SecurityWeek
First conviction for promoting tax fraud on Instagram | HM Revenue & Customs (HMRC)
Cifas exposes dozens of email addresses in invite mishap • The Register
Artificial Intelligence
How AI is driving email phishing and how to beat the threat [Q&A] - BetaNews
Executives Fear AI Cyber Threats Could Outpace Defenses
Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US - SecurityWeek
Companies want the benefits of AI without the cyber blowback - Help Net Security
Survey: Cybersecurity Teams Struggling to Keep Pace in the Age of AI - Security Boulevard
It Takes Only 250 Documents to Poison Any AI Model
AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk - SecurityWeek
Malware
How infostealers have changed the cybersecurity landscape - BetaNews
Lumma Stealer Vacuum Filled by Upgraded Vidar 2.0 Infostealer - Infosecurity Magazine
Threat Actors With Stealer Malwares Processing Millions of Credentials a Day - Cyber Security News
Why traditional bot defenses are failing in the age of intelligent automation | TechRadar
Google and Check Point nuke massive YouTube malware network • The Register
TikTok videos continue to push infostealers in ClickFix attacks
North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware
Vidar Stealer 2.0 adds multi-threaded data theft, better evasion
Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure
Cybercriminals turn to stealth to bypass malware detection - BetaNews
Security Teams Must Deploy Anti-Infostealer Defenses Now - Infosecurity Magazine
Google ads for fake Homebrew, LogMeIn sites push infostealers
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
Cyber-criminals turn on each other: the story of Lumma Stealer's collapse | Fortra
Iranian hackers targeted over 100 govt orgs with Phoenix backdoor
Official Xubuntu website compromised to serve malware - Help Net Security
New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs
Bots/Botnets
Why traditional bot defenses are failing in the age of intelligent automation | TechRadar
Mobile
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide
131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign
EU watchdog attacks Britain over iPhone ‘backdoor’ demand
Why Some Apps Ask for Contacts (and What They Actually Do With Them)
6 steps to increase Android security in the enterprise | TechTarget
Denial of Service/DoS/DDoS
How to Detect and Mitigate Hit and Run DDoS Attacks - Security Boulevard
Cache poisoning vulnerabilities found in 2 DNS resolving apps - Ars Technica
Multiple Gitlab Security Vulnerabilities Let Attackers Trigger DoS Condition
Internet of Things – IoT
Is Your Car a BYOD Risk? Researchers Demonstrate How
Your smart building isn't so smart without security - Help Net Security
When everything's connected, everything's at risk - Help Net Security
Bombarding Cars With Lasers: Novel Auto Attacks Emerge
Data Breaches/Leaks
Over 266,000 F5 BIG-IP instances exposed to remote attacks
Hackers Had Been Lurking in Cyber Firm F5 Systems Since 2023
F5 Networks Breach: A Wake-Up Call for Supply Chain Cybersecurity - Security Boulevard
183 million email accounts just got compromised. Check if you're affected | PCWorld
ICO defends decision not to investigate MoD Afghan data leak • The Register
FinWise data breach shows why encryption is your last defense
John Bolton charged over classified emails after Iranian hack of his AOL account
MoD probes claims Russian hackers stole files on bases - BBC News
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws | CSO Online
Cifas exposes dozens of email addresses in invite mishap • The Register
American Airlines Subsidiary Envoy Air Hit by Oracle Hack - SecurityWeek
Hundreds of masked ICE agents doxxed by hackers, as personal details posted on Telegram
Organised Crime & Criminal Actors
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People - SecurityWeek
Hackers Attacking Remote Desktop Protocol Services With 30,000+ New IP Addresses Daily
Russian Government Now Actively Managing Cybercrime Groups: Security Firm - SecurityWeek
Cyber-criminals turn on each other: the story of Lumma Stealer's collapse | Fortra
Not Just Spies: Satellite Operators Say Cybercrime Is Major Threat
Russia Pivots, Cracks Down on Resident Hackers
Ex-Uber CSO talks teen cyber crims, CISO role with The Reg • The Register
Insider Risk and Insider Threats
Security Leaders Share Why 77% Organizations Lose Data Due to Insider Risks | Security Magazine
Are we human or are we security risk? - BetaNews
Insurance
Cyber war perception hindering capital and market growth: Johansmeyer at Convergence - Artemis.bm
Supply Chain and Third Parties
JLR hack 'is costliest cyber attack in UK history', experts say - BBC News
The next cyber crisis may start in someone else's supply chain - Help Net Security
Third party breaches out of control experts warn
F5 Networks Breach: A Wake-Up Call for Supply Chain Cybersecurity - Security Boulevard
UK Ministry of Defense Probes Military Contractor Data Leak
Third-Party Breaches: Why Vendor Passwords Put Your Organization at Risk - Security Boulevard
Japanese retailer Muji halted online sales after a ransomware attack on logistics partner
American Airlines subsidiary Envoy confirms Oracle data theft attack
Cloud/SaaS
AWS outage crashes Amazon, PrimeVideo, Fortnite, Perplexity and more
AWS Outage: Billions Lost, Multi-Cloud Is Wall Street’s Solution
Cybersecurity expert offers blunt verdict on AWS outage - TheStreet
AWS outage exposes Achilles heel: central control plane • The Register
What the Huge AWS Outage Reveals About the Internet | WIRED
Amazon cloud outage fuels call for Europe to limit reliance on US tech – POLITICO
CyberCube estimates preliminary AWS outage loss range of $38-581m - Reinsurance News
Inside the messy reality of Microsoft 365 management - Help Net Security
Zoom isn't as private as you think. Here's how to lock it down | PCWorld
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws | CSO Online
Outages
AWS outage crashes Amazon, PrimeVideo, Fortnite, Perplexity and more
Cybersecurity expert offers blunt verdict on AWS outage - TheStreet
AWS outage exposes Achilles heel: central control plane • The Register
What the Huge AWS Outage Reveals About the Internet | WIRED
Amazon cloud outage fuels call for Europe to limit reliance on US tech – POLITICO
Identity and Access Management
Encryption
EU watchdog attacks Britain over iPhone ‘backdoor’ demand
FinWise data breach shows why encryption is your last defense
Linux and Open Source
Europe's plan to ditch US tech giants is built on open source - and it's gaining steam | ZDNET
Amazon cloud outage fuels call for Europe to limit reliance on US tech – POLITICO
Official Xubuntu website compromised to serve malware - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Threat Actors With Stealer Malwares Processing Millions of Credentials a Day - Cyber Security News
Millions rely on just one password for everything | Cybernews
Third-Party Breaches: Why Vendor Passwords Put Your Organization at Risk - Security Boulevard
183 million email accounts just got compromised. Check if you're affected | PCWorld
Social Media
Google and Check Point nuke massive YouTube malware network • The Register
Dissecting YouTube’s Malware Distribution Network - Check Point Research
Don't be fooled by this massive YouTube scam network - how to protect yourself | ZDNET
TikTok videos continue to push infostealers in ClickFix attacks
First conviction for promoting tax fraud on Instagram | HM Revenue & Customs (HMRC)
Training, Education and Awareness
Phishing training needs a new hook — here’s how to rethink your approach | CSO Online
Regulations, Fines and Legislation
UK cyber law delays 'deeply concerning,' say MPs | The Record from Recorded Future News
Experian fined $3.2 million for mass-collecting personal data
EU watchdog attacks Britain over iPhone ‘backdoor’ demand
ICO defends decision not to investigate MoD Afghan data leak • The Register
US ‘slipping’ on cybersecurity, annual Cyberspace Solarium Commission report concludes | CyberScoop
Behind the struggle for control of the CVE program | CyberScoop
The US government shutdown is a wake-up call for cyber self-reliance | Computer Weekly
Trump's workforce cuts blamed as America's cyber edge dulls • The Register
Models, Frameworks and Standards
Experian fined $3.2 million for mass-collecting personal data
Careers, Working in Cyber and Information Security
Future Cybersecurity Workforce: Beyond Degrees, Toward Durable Skills
Why ex-military professionals are a good fit for cybersecurity - Help Net Security
Hiring Won’t Fix the Cyber Talent Gap: Building a Self-Improving Workforce Will
Law Enforcement Action and Take Downs
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People - SecurityWeek
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide
Former Director at US Hacking Tool Provider May Have Sold Secrets to Russia
First conviction for promoting tax fraud on Instagram | HM Revenue & Customs (HMRC)
Three arrested in UK on suspicion of assisting Russian intelligence service | UK news | The Guardian
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns | Trend Micro (US)
Electronic Warfare Puts Commercial GPS Users on Notice
Cyberespionage campaign PassiveNeuron targets machines running Windows Server | Securelist
The UK military says Russia targets its satellites on a weekly basis. What can be done about it?
Are we already witnessing space warfare in action: 'This is not just posturing' | Space
Cyber war perception hindering capital and market growth: Johansmeyer at Convergence - Artemis.bm
China
Hackers Had Been Lurking in Cyber Firm F5 Systems Since 2023
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns | Trend Micro (US)
Salt Typhoon Uses Citrix Flaw in Global Cyber-Attack - Infosecurity Magazine
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
Reconfiguring U.S. Cyber Strategy in the Wake of Salt Typhoon | Lawfare
Researchers track surge in high-level Smishing Triad activity | CyberScoop
China accuses US of cyberattack on national time center | AP News
Russia
Russian Government Now Actively Managing Cybercrime Groups: Security Firm - SecurityWeek
Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US - SecurityWeek
Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure
The UK military says Russia targets its satellites on a weekly basis. What can be done about it?
MoD probes claims Russian hackers stole files on bases - BBC News
Teen Tied to Russian Hackers in Dutch Cyber Espionage Probe - Infosecurity Magazine
EU and Ukraine deepen cooperation on cyber security - EU NEIGHBOURS east
Former Director at US Hacking Tool Provider May Have Sold Secrets to Russia
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
Three arrested in UK on suspicion of assisting Russian intelligence service | UK news | The Guardian
PhantomCaptcha ClickFix attack targets Ukraine war relief orgs
Russia-linked hackers claim responsibility for Collins Aerospace cyber attack - Defence Connect
Golfwear giant allegedly targeted by Russian hackers | Cybernews
Iran
John Bolton charged over classified emails after Iranian hack of his AOL account
MuddyWater Targets 100+ MEA Gov Entites With Backdoor
Iranian hackers targeted over 100 govt orgs with Phoenix backdoor
North Korea
North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware
How Lazarus Group used fake job ads to spy on Europe's drone and defense sector - Help Net Security
Lazarus Group Hunts European Drone Manufacturing Data
The Leak That Targeted the Leakers
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
How Business Leaders Can Turn Geopolitical Uncertainty Into Strategic Opportunity
Tools and Controls
Why traditional bot defenses are failing in the age of intelligent automation | TechRadar
How infostealers have changed the cybersecurity landscape - BetaNews
Executives Fear AI Cyber Threats Could Outpace Defenses
Hackers Attacking Remote Desktop Protocol Services With 30,000+ New IP Addresses Daily
Cybercriminals turn to stealth to bypass malware detection - BetaNews
Security Teams Must Deploy Anti-Infostealer Defenses Now - Infosecurity Magazine
Securing AI to Benefit from AI
Network security devices endanger orgs with ’90s era flaws | CSO Online
Is EDR Giving You a False Sense of Security? - Infosecurity Magazine
Microsoft disables File Explorer preview for downloads to block attacks
Zero Trust Has a Blind Spot—Your AI Agents
When Your Backups Become the Target: Building Cyber Resilience That Lasts | Dell
Former Director at US Hacking Tool Provider May Have Sold Secrets to Russia
CISOs’ security priorities reveal an augmented cyber agenda | CSO Online
China accuses US of cyberattack on national time center | AP News
Reports Published in the Last Week
Other News
"We Are Very Exposed": Does The UK Need A New Plan For Cyber-Attacks?
Cyber security is business survival - NCSC.GOV.UK
Cyber resilience of UK digital infrastructure - POST
Electronic Warfare Puts Commercial GPS Users on Notice
Not Just Spies: Satellite Operators Say Cybercrime Is Major Threat
IT strategy needs proactive reboot | Professional Security Magazine
Why Political Risk Is Now A Top Threat For Companies
62% of Risk Leaders Say Trade Wars Could Trigger Cyberattacks, New Riskonnect Research Finds
UK launches global cyber standards backed by international partners - UKTN
Vulnerability Management
Threat actors are exploiting flaws more quickly – here's what business leaders should do | IT Pro
Network security devices endanger orgs with ’90s era flaws | CSO Online
Behind the struggle for control of the CVE program | CyberScoop
Flawed Vendor Guidance Exposes Orgs to Avoidable Risk
Vulnerabilities
Over 266,000 F5 BIG-IP instances exposed to remote attacks
Flawed Vendor Guidance Exposes Orgs to Avoidable Risk
Microsoft fixes Windows bug breaking localhost HTTP connections
ConnectWise Patches Critical Flaw in Automate RMM Tool - SecurityWeek
Microsoft fixes one of its "highest ever" rated security flaws - here's what happened | TechRadar
Microsoft fixes Windows Server Active Directory sync issues
CISA: High-severity Windows SMB flaw now exploited in attacks
CISA Confirms Exploitation of Latest Oracle EBS Vulnerability - SecurityWeek
Oracle Releases October 2025 Patches - SecurityWeek
Windows Server emergency patches fix WSUS bug with PoC exploit
BIND Updates Address High-Severity Cache Poisoning Flaws - SecurityWeek
Cache poisoning vulnerabilities found in 2 DNS resolving apps - Ars Technica
Multiple Gitlab Security Vulnerabilities Let Attackers Trigger DoS Condition
71,000+ WatchGuard Devices Vulnerable to Remote Code Execution Attacks
Researchers uncover remote code execution flaw in abandoned Rust code library | CyberScoop
Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw
Salt Typhoon Uses Citrix Flaw in Global Cyber-Attack - Infosecurity Magazine
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws | CSO Online
TP-Link Patches Four Omada Gateway Flaws, Two Allow Remote Code Execution
Cursor, Windsurf IDEs riddled with 94+ n-day Chromium vulnerabilities
Microsoft fixes bug preventing users from opening classic Outlook
HP pulls update that broke Microsoft Entra ID auth on some AI PCs
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 17 October 2025
Black Arrow Cyber Threat Intelligence Briefing 17 October 2025:
-CISOs Urged to Rethink Tabletop Exercises as Most Incidents Are Unrehearsed
-Co-op CEO: Cyber Responsibility Lies with Senior Leaders
-UK Government: Businesses Must Prepare for Total IT Failure
-UK Security Agency Reports Sharp Rise in Cyber Attacks
-Attackers Use Valid Credentials to Breach SonicWall VPNs
-F5 Networks Confirms Long-Term Breach by Government Hackers
-Extortion Group Publishes Data from Salesforce Customer Breaches
-Microsoft: Over Half of Cyber Attacks Driven by Extortion or Ransomware
-Ransomware Attacks Surge 36% in Q3
-North Korean Attackers Use Blockchain to Evade Detection
-Russian Cyber Attacks Against NATO States Rise by 25%
-US Authorities Seize $15 Billion in Bitcoin from Crypto Scam Network
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week the UK government has given strong and clear instructions for all business leaders to plan for a cyber attack. In particular, businesses are urged to prepare for a total failure of their IT, and the CEO of UK retailer Co-op has shared her personal experience to reinforce the message, while the UK security agency reports a sharp rise in attacks.
The fallout of recent attacks is also in the media, including for users of SonicWall and Salesforce, and the continued effects of ransomware and other attacks including by nation states as well as by criminal gangs.
These themes highlight the need for cyber resilience as well as cyber security. Contact us to discuss how to achieve this in a proportionate way, including through our impartial incident response exercise simulations that are tailored to help you better manage an incident with your chosen IT and other control providers.
Top Cyber Stories of the Last Week
CISOs Urged to Rethink Tabletop Exercises as Most Incidents Are Unrehearsed
A new report reveals that 57% of major cyber incidents involved scenarios that organisations had never rehearsed. Experts argue that tabletop exercises often focus on dramatic breaches rather than realistic, subtle attack methods like lateral movement or quiet data exfiltration. Analysts recommend tailoring exercises to the organisation’s threat profile and ensuring practical readiness, such as verifying contact lists and backup communication tools. The findings highlight the need for continuous, realistic simulations that build muscle memory and align security teams with business operations.
Co-op CEO: Cyber Responsibility Lies with Senior Leaders
Following a major breach affecting 6.5 million members, the CEO of UK retailer the Co-operative has called on business leaders to take direct responsibility for cyber resilience. The attack disrupted payments and operations across the group’s businesses. In a letter published in the NCSC’s annual report, she emphasised that drills are essential and urged others to plan for continuity.
UK Government: Businesses Must Prepare for Total IT Failure
The UK National Cyber Security Centre’s annual review warns that the UK now faces four nationally significant cyber attacks per week, a 129% increase from last year. The agency urges organisations to prepare for scenarios where all IT systems are offline, including email and cloud services. Businesses should ensure their crisis plans are available in printed form, and have offline communication methods available. The report distinguishes between backups and resilience, stressing that continuity planning must assume IT failure.
Source: https://www.fortra.com/blog/ncsc-warns-companies-prepare-screens-dark
UK Security Agency Reports Sharp Rise in Cyber Attacks
The UK’s national cyber agency has reported a significant increase in cyber attacks over the past year. Threats include ransomware and state-linked espionage. The report urges organisations to improve basic cyber hygiene and prepare for incidents that may disrupt operations.
Attackers Use Valid Credentials to Breach SonicWall VPNs
Threat actors are actively exploiting SonicWall Secure Mobile Access (SMA) appliances by using valid credentials to gain unauthorised access. Once inside, they deploy malware and establish persistence. The campaign has affected organisations across multiple sectors and demonstrates the risks of credential-based access and MFA bypass.
F5 Networks Confirms Long-Term Breach by Government Hackers
Cyber security firm F5 Networks disclosed that government-backed hackers had persistent access to its systems, stealing source code and customer configuration data. The attackers infiltrated development environments and knowledge systems, exposing undisclosed vulnerabilities. Although no software was modified, the stolen data could help attackers exploit customer systems. The US Department of Justice allowed F5 to delay public disclosure due to national security concerns. The UK’s NCSC and US CISA have urged immediate patching of affected systems.
Extortion Group Publishes Data from Salesforce Customer Breaches
An extortion group known as Scattered LAPSUS$ Hunters, has leaked millions of records allegedly stolen from organisations using Salesforce services. The attackers claimed to have targeted 39 Salesforce customers, but only published data from six, including Qantas, Vietnam Airlines, and GAP. The leaked information includes names, email addresses, phone numbers, dates of birth, and loyalty program details. In one case, attackers accessed data via a third-party contact centre platform. Salesforce denied involvement, stating the incident relates to past or unsubstantiated events.
Source: https://www.securityweek.com/extortion-group-leaks-millions-of-records-from-salesforce-hacks/
Microsoft: Over Half of Cyber Attacks Driven by Extortion or Ransomware
Microsoft’s latest Digital Defence Report finds that 52% of cyber attacks with known motives were financially driven, primarily through extortion and ransomware. The report highlights the growing use of AI by attackers to automate phishing, scale social engineering and develop adaptive malware. Nation-state threats remain persistent, with China, Iran, Russia and North Korea expanding their targets. Microsoft urges leaders to treat cyber security as a strategic priority and adopt phishing-resistant MFA, which can block over 99% of identity-based attacks.
Source: https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/
Ransomware Attacks Surge 36% in Q3
New data shows a 36% year-on-year rise in ransomware attacks during Q3, with 270 publicly disclosed incidents. The emergence of 18 new ransomware groups, including DEVMAN, signals growing threat diversity. Attackers are increasingly targeting sensitive data, including children’s records, and demanding record ransoms. Experts stress the need for data protection to reduce extortion leverage and discourage repeat attacks.
Source: https://betanews.com/2025/10/16/q3-ransomware-attacks-up-36-percent-year-on-year/
North Korean Attackers Use Blockchain to Evade Detection
Researchers from Cisco Talos and Google have uncovered new malware techniques used by North Korean threat actors, including EtherHiding, which leverages public blockchains for command and control. The campaign involves fake job interviews and technical assessments that trick victims into downloading malware. The malware includes keylogging and screenshot modules, enabling persistent access and data theft. These evasive methods make takedown efforts more difficult and signal a shift in nation-state tactics.
Source: https://cyberscoop.com/north-korea-attackers-evasive-techniques-malware/
Russian Cyber Attacks Against NATO States Rise by 25%
An analysis has found a 25% year-on-year increase in Russian cyber activity targeting NATO countries. The surge includes espionage, disruption campaigns, and attacks on smaller firms seen as entry points to larger organisations. The findings suggest that Russian state actors are expanding their operations beyond Ukraine, using cybercriminal infrastructure to mask attribution and increase reach.
US Authorities Seize $15 Billion in Bitcoin from Crypto Scam Network
Law enforcement agencies in the US have seized around $15 billion in Bitcoin linked to the Prince Group, a criminal organisation accused of running a vast crypto fraud and human trafficking operation. The group allegedly laundered funds via gambling/crypto-mining businesses and complex crypto transfers from forced labour and fake investment schemes. The investigation, led by the Department of Justice, uncovered a global network of illicit financial activity. This is one of the largest crypto-related seizures to date and underscores the growing use of digital assets in organised crime.
Source: https://www.helpnetsecurity.com/2025/10/15/prince-group-crypto-scam-15-billion-in-bitcoin-seized/
Governance, Risk and Compliance
Warning to UK following spike in online attacks | The Independent
China and Russia posing ‘significant threat’ to UK in cyberspace, NCSC warns | The Standard
China poses 'highly sophisticated' cyber threat to UK, NCSC warns | UK News | Sky News
Ministers urge businesses to take cyber-attacks seriously - UKTN
Cyber-attacks rise by 50% in past year, UK security agency says | Cybercrime | The Guardian
UK security services step up work with business to fight cyber threats
Company bosses warned cyber attacks are 'not a question of if but when' | ITV News
UK Cyber Incidents Rise for Third Straight Year
Have plans on paper in case of cyber-attack, firms told - BBC News
Senior Execs Falling Short on Cyber-Attack Preparedness, NCSC Warns - Infosecurity Magazine
Move to hybrid working creates cyber risks – study
CISOs must rethink the tabletop, as 57% of incidents have never been rehearsed | CSO Online
Government urges businesses to keep paper back-ups for cyber-attack recovery | AccountingWEB
Threats
Ransomware, Extortion and Destructive Attacks
Q3 ransomware attacks up 36 percent year-on-year - BetaNews
Salesforce bandits run into hiding amid arrests, seizures • The Register
Extortion and ransomware drive over half of cyberattacks - Microsoft On the Issues
LockBit, Qilin, DragonForce form ransomware cartel | Cybernews
Third time lucky? The FBI just took down BreachForums, again | IT Pro
Scattered Lapsus$ Hunters extortion site goes dark: What’s next? | CSO Online
Qilin Ransomware announced new victims
Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign
Microsoft disrupts ransomware attacks targeting Teams users
Ransomware Victims
Co-op CEO: ‘The buck for cyber stops with us as senior leaders’ – PublicTechnology
Extortion Group Leaks Millions of Records From Salesforce Hacks - SecurityWeek
Third time lucky? The FBI just took down BreachForums, again | IT Pro
Russian hackers target software used by Treasury and NHS
Russia may have been behind Jaguar Land Rover cyber attack
Qilin Ransomware announced new victims
Qantas says customer data released by cyber criminals months after cyber breach | Reuters
Clop Ransomware group claims the hack of Harvard University
Phishing & Email Based Attacks
ClickFix attacks are surging, and Microsoft says you are the only defense | ZDNET
Phishing kit YYlaiyu impersonates 97 brands for fraud • The Register
Fresh Phishing Kit Innovation: Automated ClickFix Attacks
Microsoft remains the most imitated brand in phishing scams - BetaNews
KnowBe4 warns of new PayPal invoice phishing scam - IT Security Guru
Cyberattackers Target LastPass, Top Password Managers
LastPass Warns Customers It Has Not Been Hacked Amid Phishing Emails - Infosecurity Magazine
Other Social Engineering
ClickFix attacks are surging, and Microsoft says you are the only defense | ZDNET
Victims of romance fraud tricked out of £106m last year - BBC News
Fraud, Scams and Financial Crime
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Scam texts net over $1 billion for cyber gangs - how to avoid their traps | ZDNET
Phishing kit YYlaiyu impersonates 97 brands for fraud • The Register
The UK Dealer With Prosthetic Hands Brought Down by the World’s Biggest Dark Web Bust
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites
UK telcos step up efforts to combat ‘epidemic’ of handset fraud
Artificial Intelligence
Rise in ‘Shadow AI’ tools raising security concerns for UK
Microsoft warns of the dangers of Shadow AI • The Register
Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors
Your browser is an AI-enabled OS, so secure it like one | TechTarget
Researchers Warn of Security Gaps in AI Browsers - Infosecurity Magazine
Everyone wants AI, but few are ready to defend it - Help Net Security
UK Firms Lose Average of £2.9m to AI Risk - Infosecurity Magazine
AI Attacks Surge as Microsoft Process 100 Trillion Signals Daily - Infosecurity Magazine
Security risks of vibe coding and LLM assistants for developers
Teenager allegedly incriminates himself via conversation with AI chat bot | The Independent
CISOs brace for an “AI vs. AI” fight | CSO Online
2FA/MFA
Hackers can steal 2FA codes and private messages from Android phones - Ars Technica
New 'Pixnapping' attack lets hackers steal Android chats, 2FA codes in seconds | Mashable
Malware
New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns
New Stealit Malware Campaign Spreads via VPN and Game Installer Apps - Infosecurity Magazine
Massive multi-country botnet targets RDP services in the US
What a new mega-worm says about open source cybersecurity - Tech Monitor
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
Nation-state hackers deliver malware from “bulletproof” blockchains - Ars Technica
China's Flax Typhoon Turns Geo-Mapping into Backdoor
Bots/Botnets
New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs
Massive multi-country botnet targets RDP services in the US
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands
Mobile
Hackers can steal 2FA codes and private messages from Android phones - Ars Technica
New 'Pixnapping' attack lets hackers steal Android chats, 2FA codes in seconds | Mashable
Popular VPN app can empty bank accounts, security experts warn | The Independent
You Only Need $750 of Equipment to Pilfer Data From Satellites, Researchers Say
Researchers find a startlingly cheap way to steal your secrets from space | CyberScoop
Denial of Service/DoS/DDoS
Man Launches "World's First Waymo DDoS" by Ordering 50 Robotaxis to Dead End Street
Internet of Things – IoT
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
Man Launches "World's First Waymo DDoS" by Ordering 50 Robotaxis to Dead End Street
Humanoid robot found vulnerable to Bluetooth hack, data leaks to China - Help Net Security
Data Breaches/Leaks
US Warns of ‘Catastrophic’ Hacks After Cyber Firm F5 Breach - Bloomberg
China Accessed Classified UK Systems for a Decade, Officials Say - Bloomberg
Third time lucky? The FBI just took down BreachForums, again | IT Pro
Attackers exploit valid logins in SonicWall SSL VPN compromise
Prospect union tells members their data was breached in June • The Register
Capita fined £14M after 58-hour delay exposed 6.6M records • The Register
The company Discord blamed for its recent breach says it wasn't hacked
Over 23 Million Victims Hit by Data Breaches in Q3 - Infosecurity Magazine
How Cybercriminal Organizations Weaponize Exposed Secrets - Security Boulevard
Spanish fashion retailer MANGO disclosed a data breach
Auction giant Sotheby’s says data breach exposed financial information
Cabinet Office rejects Cummings' claim that China breached high-level systems - BBC News
8 Auto Insurance Providers to Pay New York $19M Over Data Breaches
They were victims of a massive data breach in 2009. Their employer denied it for a decade | CBC News
Have I Been Pwned: Prosper data breach impacts 17.6 million accounts
Organised Crime & Criminal Actors
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Scam texts net over $1 billion for cyber gangs - how to avoid their traps | ZDNET
The UK Dealer With Prosthetic Hands Brought Down by the World’s Biggest Dark Web Bust
UK and US impose sanctions on alleged Cambodian ‘cyber-scam’ network
Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained
PowerSchool hacker sentenced to 4 years in prison | CyberScoop
Attackers don’t linger, they strike and move on - Help Net Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Scam texts net over $1 billion for cyber gangs - how to avoid their traps | ZDNET
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites
Insurance
Ransomware costs soar as cyber claims decline - Insurance Post
How Ransomware’s Data Theft Evolution is Rewriting Cyber Insurance Risk Models - Security Boulevard
Supply Chain and Third Parties
Capita fined £14M after 58-hour delay exposed 6.6M records • The Register
Russian hackers target software used by Treasury and NHS
Russia may have been behind Jaguar Land Rover cyber attack
Supply Chain Risks Lurking in VS Code Marketplaces
The company Discord blamed for its recent breach says it wasn't hacked
Why vendor risk management can’t be an afterthought
Software Supply Chain
Supply Chain Risks Lurking in VS Code Marketplaces
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns
Cloud/SaaS
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
Fresh Phishing Kit Innovation: Automated ClickFix Attacks
Microsoft investigates outage affecting Microsoft 365 apps
Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign
Microsoft disrupts ransomware attacks targeting Teams users
Outages
Microsoft investigates outage affecting Microsoft 365 apps
Identity and Access Management
The password problem we keep pretending to fix - Help Net Security
Linux and Open Source
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
What a new mega-worm says about open source cybersecurity - Tech Monitor
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
New Rootkit Campaign Exploits Cisco SNMP Flaw to Gain Persistence - Infosecurity Magazine
German state replaces Microsoft Exchange and Outlook with open-source email | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
SonicWall VPN accounts breached using stolen creds in widespread attacks
The password problem we keep pretending to fix - Help Net Security
New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands
Cyberattackers Target LastPass, Top Password Managers
LastPass Warns Customers It Has Not Been Hacked Amid Phishing Emails - Infosecurity Magazine
Legacy Windows Protocols Still Expose Networks to Credential Theft - Infosecurity Magazine
Social Media
How to secure corporate social media accounts before they become a breach vector | SC Media
Regulations, Fines and Legislation
Capita fined £14M after 58-hour delay exposed 6.6M records • The Register
Banks failing to curb rise in romance fraud, says UK watchdog
Victims of romance fraud tricked out of £106m last year - BBC News
Ofcom fines 4chan £20K for Online Safety Act failings • The Register
Cyber Resilience Act: The Clock is Ticking for Compliance | White & Case LLP - JDSupra
Cisco faces Senate scrutiny over firewall flaws • The Register
8 Auto Insurance Providers to Pay New York $19M Over Data Breaches
The Things that Bedevil U.S. Cyber Power
The End of Cybersecurity | Foreign Affairs
Models, Frameworks and Standards
Cyber Resilience Act: The Clock is Ticking for Compliance | White & Case LLP - JDSupra
Law Enforcement Action and Take Downs
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites
The UK Dealer With Prosthetic Hands Brought Down by the World’s Biggest Dark Web Bust
Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained
PowerSchool hacker sentenced to 4 years in prison | CyberScoop
Third time lucky? The FBI just took down BreachForums, again | IT Pro
BreachForums seized, but hackers say they will still leak Salesforce data
Teenager allegedly incriminates himself via conversation with AI chat bot | The Independent
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Russian cyber-attacks against Nato states up by 25% in a year, analysis finds | Nato | The Guardian
Nation State Actors
Ministers urge businesses to take cyber-attacks seriously - UKTN
Ministerial letter on cyber security to leading UK companies - GOV.UK
NCSC demands action amid 50% surge in major UK cyberattacks • The Register
UK security services step up work with business to fight cyber threats
US Warns of ‘Catastrophic’ Hacks After Cyber Firm F5 Breach - Bloomberg
F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data - SecurityWeek
Thousands of customers imperiled after nation-state ransacks F5’s network - Ars Technica
Nation-state hackers deliver malware from “bulletproof” blockchains - Ars Technica
China
China and Russia posing ‘significant threat’ to UK cyberspace, experts warn | The Independent
China poses 'highly sophisticated' cyber threat to UK, NCSC warns | UK News | Sky News
Cyber-attacks rise by 50% in past year, UK security agency says | Cybercrime | The Guardian
Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year
Netherlands seizes Chinese-owned microchip maker to protect national security
China Accessed Classified UK Systems for a Decade, Officials Say - Bloomberg
Cabinet Office rejects Cummings' claim that China breached high-level systems - BBC News
China's Flax Typhoon Turns Geo-Mapping into Backdoor
The controversy over the collapsed China spy case explained - BBC News
Badenoch demands PM address 'unanswered' China spy case questions - BBC News
Taiwan faces 2.8 million Chinese cyberattacks a day | Taiwan News | Oct. 14, 2025 10:05
Humanoid robot found vulnerable to Bluetooth hack, data leaks to China - Help Net Security
Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months
Phishing kit YYlaiyu impersonates 97 brands for fraud • The Register
Russia
China and Russia posing ‘significant threat’ to UK cyberspace, experts warn | The Independent
China poses 'highly sophisticated' cyber threat to UK, NCSC warns | UK News | Sky News
Cyber-attacks rise by 50% in past year, UK security agency says | Cybercrime | The Guardian
Russian cyber-attacks against Nato states up by 25% in a year, analysis finds | Nato | The Guardian
Russian hackers target software used by Treasury and NHS
Russia may have been behind Jaguar Land Rover cyber attack
Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors
Chinese cyberspies compromised Russian tech provider • The Register
Hacktivists deactivate after falling into researchers' trap • The Register
Iran
Iran is not initiating cyberattacks against any country - Mehr News Agency
North Korea
Tools and Controls
Your browser is an AI-enabled OS, so secure it like one | TechTarget
CISOs must rethink the tabletop, as 57% of incidents have never been rehearsed | CSO Online
The password problem we keep pretending to fix - Help Net Security
Why vendor risk management can’t be an afterthought
Massive multi-country botnet targets RDP services in the US
Researchers Warn of Security Gaps in AI Browsers - Infosecurity Magazine
Everyone’s adopting AI, few are managing the risk - Help Net Security
Hackers Turn Velociraptor DFIR Tool Into Weapon in LockBit Ransomware Attacks
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign - SecurityWeek
Inside the CISO Mind: How Security Leaders Choose Solutions - Security Boulevard
Legacy Windows Protocols Still Expose Networks to Credential Theft - Infosecurity Magazine
Popular VPN app can empty bank accounts, security experts warn | The Independent
Security risks of vibe coding and LLM assistants for developers
How Ransomware’s Data Theft Evolution is Rewriting Cyber Insurance Risk Models - Security Boulevard
3 firmware security failures that show how little motherboard manufacturers care
Other News
Satellites Are Leaking the World’s Secrets: Calls, Texts, Military and Corporate Data | WIRED
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign - SecurityWeek
Critical infrastructure CISOs Can't Ignore Office Data
Why the web-hosting industry needs a trust seal | CyberScoop
Dull but dangerous: A guide to 15 overlooked cybersecurity blind spots | CSO Online
The power grid is getting old, and so is the cybersecurity protecting it - Help Net Security
EU's biometric border system suffers teething problems • The Register
Leak From the Sky: It Turns Out a Lot of Satellite Data Is Unencrypted | PCMag
Legacy Windows Protocols Still Expose Networks to Credential Theft - Infosecurity Magazine
The solar power boom opened a backdoor for cybercriminals - Help Net Security
Focus on cyber security essential, says Taoiseach
How This Overlooked Risk Can Collapse Your Startup Overnight
Vulnerability Management
Final Windows 10 Patch Tuesday update rolls out as support ends
Windows 10 Still on Over 40% of Devices as It Reaches End of Support - SecurityWeek
Microsoft: Exchange 2016 and 2019 have reached end of support
CVE, CVSS scores need overhauling, argues Codific CEO • The Register
Security firms dispute credit for overlapping CVE reports
Vulnerabilities
F5 releases BIG-IP patches for stolen security vulnerabilities
Cisco faces Senate scrutiny over firewall flaws • The Register
Attackers exploit valid logins in SonicWall SSL VPN compromise
Experts Warn of Widespread SonicWall VPN Compromise Impacting Over 100 Accounts
New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login
Microsoft frightful Patch Tuesday: 175+ CVEs, 3 under attack • The Register
Critical Veeam Backup RCE Vulnerabilities Let Attackers Execute Malicious Code Remotely
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign - SecurityWeek
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities - SecurityWeek
High-Severity Vulnerabilities Patched by Fortinet and Ivanti - SecurityWeek
Adobe Patches Critical Vulnerability in Connect Collaboration Suite - SecurityWeek
CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack
Microsoft patches ASP.NET Core bug rated highly critical • The Register
Juniper patched nine critical flaws in Junos Space
SAP Patches Critical Vulnerabilities in NetWeaver, Print Service, SRM - SecurityWeek
Gladinet Patches Exploited CentreStack Vulnerability - SecurityWeek
Final Windows 10 Patch Tuesday update rolls out as support ends
Windows 10 Still on Over 40% of Devices as It Reaches End of Support - SecurityWeek
Oracle rushes out another emergency E-Business Suite patch • The Register
Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Advisory 16 October 2025 - Security Updates from Microsoft, SAP, Fortinet, Ivanti and Oracle (E-Business Suite)
Black Arrow Cyber Advisory 16 October 2025 - Security Updates from Microsoft, SAP, Fortinet, Ivanti and Oracle (E-Business Suite)
Executive Summary
This month’s updates span Microsoft’s regular Patch Tuesday release, SAP’s Security Patch Day, large batches from Fortinet across network and endpoint products, targeted fixes from Ivanti for enterprise mobility/secure access, and a standalone Oracle Security Alert for E-Business Suite issued on 11 October. Prioritise actively exploited Windows issues (where present), SAP high and critical security notes, Fortinet gateway/endpoint components, Ivanti EPM/EPMM/Neurons platforms, and Oracle E-Business Suite where exposure is internet-facing.
Vulnerabilities by Vendor
Microsoft: 173 vulnerabilities including five critical-severity security defects and two flaws that have been exploited in the wild.Vulnerabilies affecting Windows (client/server), Office/SharePoint, .NET/Visual Studio, Azure services, and Microsoft Edge (Chromium). Prioritise patches addressing any actively exploited items and Critical RCE/EoP paths in Windows and server components.
SAP: 16 new and updated patches as part of its monthly rollout, across on-prem and cloud product families (e.g., NetWeaver, S/4HANA, Business Objects). Prioritise High/Critical security notes and authentication/authorisation weaknesses.
Fortinet: 29 advisories across FortiOS/FortiProxy, FortiDLP, FortiClient, FortiIsolator, FortiPAM, FortiManager/Analyzer, FortiADC/FortiWeb and others. Prioritise High/Critical items on perimeter firewalls, proxies and endpoint agents; review PSIRT entries for products you operate.
Ivanti: Several updates across Endpoint Manager (EPM), End Point Manager Mobile (EPMM) and Neurons. Prioritise High/Critical updates for EPM and EPMM; apply latest EPM/EPMM and Neurons updates if not yet deployed.
Oracle (E-Business Suite only): 1 vulnerability (Security Alert CVE-2025-61884, released 11 October 2025), affecting E-Business Suite 12.2.3–12.2.14. Vulnerability is remotely exploitable without authentication; prioritise immediate patching on any externally accessible instances.
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
Sources:
1 Microsoft — https://msrc.microsoft.com/update-guide
2 SAP — https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2025.html
3 Fortinet — https://www.fortiguard.com/psirt
4 Ivanti — https://www.ivanti.com/blog/october-2025-security-update
5 Oracle — (E-Business Suite Security Alert CVE-2025-61884) — https://www.oracle.com/security-alerts/alert-cve-2025-61884.html