Black Arrow Cyber Threat Intelligence Briefing 28 February 2025
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
The last week has identified several critical cyber security threats that demand immediate attention from business leaders. Third-party risk has become a major concern, with supply chain vulnerabilities now driving 31% of cyber insurance claims. Attackers are also leveraging new techniques, such as MFA fatigue and AI-powered phishing, to bypass traditional defences. The emergence of sophisticated phishing toolkits and deepfake fraud highlights the growing challenge of verifying digital identities, while mobile phishing (mishing) is increasingly targeting employees through personal devices.
The accelerating pace of cyber threats is evident, with 25 new malware variants created every hour and cyber criminals leveraging AI and automation to exfiltrate data at unprecedented speeds, sometimes within minutes. Meanwhile, ransomware actors are shifting strategies, focusing 80% of attacks on data theft rather than encryption, making traditional defences less effective. The surge in generative AI usage within enterprises, often without IT oversight, introduces further risks, including data leakage and code exposure.
Black Arrow Cyber believes that businesses must adopt a proactive, layered security approach. This includes real-time threat detection, robust vendor risk management, AI-driven fraud prevention, and enhanced employee training. With cyber extortion demands rising sharply and operational disruptions increasing, organisations that fail to adapt will face significant financial, operational, and reputational consequences.
Top Cyber Stories of the Last Week
Cyber Security's Biggest Blind Spot: Third-Party Risk
Cyber insurer Resilience has identified third-party risk as a leading driver of cyber insurance claims, accounting for 31% of all claims in 2024. Notably, for the first time, these risks led to direct financial losses, making up 23% of incurred claims. Ransomware remained a major cause, linked to 61% of losses, while transfer fraud increased to 18%. Sectors such as healthcare, finance, and manufacturing were most affected. The findings highlight the growing need for businesses to assess not just their own cyber security, but also that of their vendors to mitigate financial and operational risks.
Cyber Criminals Can Now Clone Any Legitimate Website, and It’s Pretty Terrifying
Researchers have identified a surge in activity around a new phishing toolkit, called Darcula-suite 3.0, which enables cyber criminals to clone legitimate websites with ease. This development significantly lowers the barrier for less technical attackers, allowing them to impersonate trusted brands and steal sensitive information. The toolkit includes an admin panel to track successful attacks and even generate fraudulent payment card details. As phishing scams grow more sophisticated with AI-driven enhancements, organisations must strengthen their cyber security measures to mitigate the risk of falling victim to these increasingly convincing attacks.
Over 25 New Malware Variants Created Every Single Hour
SonicWall’s latest research highlights an alarming rise in cyber threats, with 637 new malware variants detected daily; more than 25 every hour. Encrypted threats have surged by 92%, with attackers leveraging TLS encryption to bypass defences. Security teams are under increasing strain, with burnout and mental health concerns on the rise. Despite the urgency, some organisations take up to 150 days to apply critical patches, leaving them exposed. With cyber attacks doubling in cost in 2024, businesses must move beyond legacy defences and adopt real-time threat monitoring and security operations centre (SOC) capabilities to stay ahead of increasingly sophisticated threats.
Understanding MFA Fatigue: Why Cyber Criminals Are Exploiting Human Behaviour
MFA fatigue attacks are emerging as a critical cyber security threat, exploiting human behaviour rather than technical vulnerabilities. Attackers overwhelm users with repeated MFA prompts, hoping frustration or confusion will lead to accidental approval. High-profile breaches, including Uber in 2022, highlight the risks. Cyber criminals often pair push spamming with social engineering to increase success rates. Organisations must move beyond reliance on MFA alone by implementing phishing-resistant authentication, monitoring for excessive login attempts, and training staff to recognise and report unusual activity. A layered security approach is essential to counter these evolving tactics and protect critical systems.
Only a Fifth of Ransomware Attacks Now Encrypt Data
ReliaQuest’s latest report reveals that ransomware actors are increasingly abandoning encryption, with 80% of attacks in 2024 focused solely on data exfiltration, which is 34% faster. Service accounts were a key vulnerability, implicated in 85% of breaches, while insufficient logging was identified as the leading cause of security failures. Two-thirds of critical intrusions involved legitimate software, and a quarter stemmed from exploited public-facing applications. The report urges organisations to enhance monitoring, deploy AI-driven automation, and strengthen endpoint security to keep pace with increasingly rapid cyber threats.
Biggest Crypto Heist in History, Worth $1.5Bn, Linked to North Korea Hackers
A cyber attack on the Dubai-based cryptocurrency exchange Bybit resulted in the theft of an estimated $1.5bn, with analysts attributing the breach to North Korea’s Lazarus Group. Experts report that malware was used to authorise fraudulent transactions, with the stolen funds allegedly laundered to support North Korea’s missile programme. Bybit has offered a $140m bounty to trace and freeze the stolen assets. Blockchain analysis indicates North Korea-linked hackers were responsible for one in five crypto breaches in 2024, stealing $1.34bn across 47 incidents, up from $660m across 20 incidents the previous year.
89% of Enterprise GenAI Usage is Invisible to Organisations, Exposing Critical Security Risks
A new report by LayerX highlights a significant blind spot in enterprise security, revealing that nearly 90% of generative AI (GenAI) usage occurs without IT oversight. This lack of visibility increases risks such as data leakage and unauthorised access. While only 15% of employees use GenAI daily, 50% engage with these tools at least biweekly. Notably, 39% of frequent users are software developers, raising concerns over proprietary code exposure. Additionally, half of all data pasted into GenAI tools contains corporate information, underscoring the urgent need for robust security measures to manage ‘shadow AI’ and protect sensitive business data.
Combating Deepfakes in Financial Services: A Call to Action
Deepfake fraud is emerging as a critical threat to financial institutions. Criminals use AI-generated video and audio to bypass traditional security measures, impersonating executives and manipulating high-value transactions. One incident saw an organisation transfer $25 million following a deepfake video call. To combat this, financial firms must adopt advanced identity verification, including liveness detection and AI-driven fraud analysis. A layered security approach, combined with employee awareness and customer education, is essential to mitigating risk and maintaining trust in digital banking.
Threat Actors Are Increasingly Trying to Grind Business to a Halt
Palo Alto Networks’ Unit 42 found that nearly 9 in 10 cyber attacks it responded to last year led to business disruption, with organisations facing operational downtime, fraud-related losses and reputational damage. Attackers increasingly use disruption as leverage, alongside encryption and data theft, to pressure victims into paying. The median extortion demand surged by almost 80% to $1.25 million in 2024, though negotiated payments averaged $267,500. Critical infrastructure sectors, including health care and manufacturing, were particularly targeted. These findings highlight the growing threat of cyber extortion and the increasing financial and operational toll on businesses.
With AI and Automation, Hackers are Stealing Data at Unprecedented Speeds
ReliaQuest’s Annual Cyber-Threat Report highlights how AI and automation are accelerating cyber attacks, with hackers now exfiltrating critical data in record time. On average, attackers achieve lateral movement within 48 minutes, with the fastest observed data theft occurring in just 4 hours and 29 minutes. Ransomware groups increasingly prioritise data exfiltration over encryption, with 80% of attacks focused on stealing information. In 60% of cases, stolen data is sent to legitimate cloud platforms. With the threat landscape evolving rapidly, organisations must rethink their response strategies to detect and mitigate attacks before critical assets are compromised.
Mobile Phishing Attacks on the Rise
Mishing (mobile phishing) attacks have risen sharply, with one major global campaign compromising over 600 organisations. Attackers are increasingly using advanced social engineering tactics, including device-aware phishing and geolocation-based redirection, making scams more targeted and harder to detect. The rise in Bring Your Own Device policies and reduced user verification of URLs have contributed to this trend. Security experts highlight the need for organisations to adapt, recommending mobile threat defence, phishing-resistant multi-factor authentication, clear Bring Your Own Device policies, and strong password management to counter the growing risk of credential-based attacks.
With Millions Upon Millions of Victims, Scale of Info-Stealer Malware Laid Bare
A vast trove of stolen credentials has been added to the privacy-breach-notification service ‘Have I Been Pwned’ (HIBP) after a government agency tipped off its founder, Troy Hunt. The dataset, linked to the "Alien Txtbase" Telegram channel, comprises 1.5TB of data, including 23 billion records and 284 million unique email addresses, harvested by info-stealer malware. HIBP has integrated 244 million new passwords and updated 199 million existing ones. Attackers increasingly exploit stolen credentials to bypass security, with new HIBP APIs now enabling organisations to check if their domains are compromised, reinforcing the need for strong cyber security measures.
Sources:
https://www.xda-developers.com/cybercriminals-clone-legitimate-website/
https://www.infosecurity-magazine.com/opinions/healthcare-ai-fight-cyber-attacks/
https://thehackernews.com/2025/02/89-of-enterprise-genai-usage-is.html
https://cyberscoop.com/cyberattacks-business-disruption-2025-unit-42-palo-alto-networks/
https://cybernews.com/security/hackers-stealing-data-at-unprecedented-speeds/
https://www.scworld.com/brief/mobile-phishing-attacks-on-the-rise
https://www.theregister.com/2025/02/26/hibp_adds_giant_infostealer_trove/
Governance, Risk and Compliance
Threat actors are increasingly trying to grind business to a halt | CyberScoop
Geopolitical Tension Fuels APT and Hacktivism Surge - Infosecurity Magazine
The Time to Speak to Employees About Insider Risk Is Now
Cyber attacks Become Increasingly Efficient | MSSP Alert
The CISO's dilemma of protecting the enterprise while driving innovation - Help Net Security
Insurers still concerned over cyber risk unknowns
Data: Cyber threats skyrocket as attackers think like businesses | Capacity Media
The Future of Auditing: What to Look for in 2025 - Security Boulevard
Cyber security professionals face expanding responsibilities, with 61% covering multiple domains
Threats
Ransomware, Extortion and Destructive Attacks
Only a Fifth of Ransomware Attacks Now Encrypt Data - Infosecurity Magazine
AI is helping hackers get access to systems quicker than ever before | TechRadar
FBI Has Warned About 'Ghost' Cyber Attacks. What You Need to Know. - Business Insider
Warning issued over prolific 'Ghost' ransomware group | ITPro
New Anubis Ransomware Could Pose Major Threat to Organisations - SecurityWeek
EncryptHub breaches 618 orgs to deploy infostealers, ransomware
With AI and automation, hackers are stealing data at unprecedented speeds | Cybernews
23 Vulnerabilities in Black Basta's Chat Logs Exploited in Wild
CL0P Ransomware Attacking Telecommunications & Healthcare Sectors In Large Scale
Threat actors are increasingly trying to grind business to a halt | CyberScoop
Massive leak exposes the inner workings of top ransomware syndicate Black Basta | TechSpot
Black Basta ransomware leak sheds light on targets, tactics | TechTarget
NCC Group tracks alarming ransomware surge in January | TechTarget
A landscape forever altered? The LockBit takedown one year on | Computer Weekly
Should ransomware payments be illegal? | TechRadar
Black Basta Goes Dark Amid Infighting, Chat Leaks Show
Targeted by Ransomware, Middle East Banks Shore Up Security
Dragos: Ransomware attacks against industrial orgs up 87% | TechTarget
Ransomware Victims
Ransomware attack on Southern Water cost £4.5 million – DataBreaches.Net
Hackers claim responsibility for NHS provider attack - BBC News
DISA took a year to disclose a breach affecting 3.3M+ people • The Register
DragonForce Ransomware Group is Targeting Saudi Arabia
'Paddington' victim of Russian cyber attack
Ransomware Gang Publishes Stolen Genea IVF Patient Data - Infosecurity Magazine
LockBit taunts FBI Director Kash Patel with alleged “Classified” leak threat
Home Depot Refutes Clop Ransomware Attack Claims | MSSP Alert
Phishing & Email Based Attacks
Cyber criminals can now clone any legitimate website, and it's pretty terrifying
Cyber Crooks Exploit URL Manipulation In Sophisticated Phishing Scam
Forget phishing, now "mishing" is the new security threat to worry about | TechRadar
Cyber Criminals Can Now Clone Any Brand's Site in Minutes Using Darcula PhaaS v3
Job Application Spear Phishing - Security Boulevard
Deceptive Signatures: Advanced Techniques in BEC Attacks
Beware: PayPal "New Address" feature abused to send phishing emails
FatalRAT Phishing Attacks Target APAC Industries Using Chinese Cloud Services
Be careful! That legit PayPal email might be a phishing scam | PCWorld
How I Keep Myself Safe From Phishing When I Work From Home
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Deceptive Signatures: Advanced Techniques in BEC Attacks
Other Social Engineering
Understanding MFA Fatigue: Why Cyber Criminals Are Exploiting Human Behaviour - IT Security Guru
CrowdStrike Security Report: Generative AI Powers Social Engineering Attacks
One wrong SMS can wipe your savings, thanks to this Android Trojan | Cybernews
Pump.fun X account hacked to promote scam governance token
DeepSeek-Spoofing Leveraged For Crypto Exfiltration | MSSP Alert
Artificial Intelligence
Deep trouble: Deepfakes and their implications for cyber security - Verdict
4 Low-Cost Ways to Defend Your Organisation From Deepfakes
Combating Deepfakes in Financial Services: A Call to Action: By Adam Preis
AI is helping hackers get access to systems quicker than ever before | TechRadar
With AI and automation, hackers are stealing data at unprecedented speeds | Cybernews
CrowdStrike Security Report: Generative AI Powers Social Engineering Attacks
The truth about GenAI security: your business can't afford to “wait and see” | TechRadar
The First International AI Safety Report: A Call To Action
Quarter of Brits Report Deepfake Phone Scams - Infosecurity Magazine
Microsoft names cyber criminals behind AI deepfake network
AI-Powered Deception is a Menace to Our Societies
Why AI deployment requires a new level of governance - Help Net Security
AI Is Everywhere Since October 7, From the Battlefield to the Cyber Arena - The Media Line
DeepSeek-Spoofing Leveraged For Crypto Exfiltration | MSSP Alert
OpenAI Bans Accounts Misusing ChatGPT for Surveillance and Influence Campaigns
Nearly a third of UK public sector IT professionals anxious about AI security risks
2FA/MFA
Understanding MFA Fatigue: Why Cyber Criminals Are Exploiting Human Behaviour - IT Security Guru
Chinese Botnet Bypasses MFA in Microsoft 365 Attacks - Infosecurity Magazine
Hackers are on a huge Microsoft 365 password spraying spree – here’s what you need to know | ITPro
Why Gmail is replacing SMS codes with QR codes - and what it means for you | ZDNET
Malware
Scale of unstoppable info-stealer malware laid bare • The Register
Cyber criminals prefer remote tools over malware, says CrowdStrike | SC Media
Why ‘malware as a service’ is becoming a serious problem | ITPro
Have I Been Pwned adds 284M accounts stolen by infostealer malware
Is your email or password among the 240+ million compromised by infostealers? - Help Net Security
3.9 Billion Passwords Stolen—Infostealer Malware Blamed
EncryptHub breaches 618 orgs to deploy infostealers, ransomware
AI malware pioneers | Cybernews
New Malware Campaign Uses Cracked Software to Spread Lumma and ACR Stealer
5 Active Malware Campaigns in Q1 2025
2,500+ Truesight.sys Driver Variants Exploited to Bypass EDR and Deploy HiddenGh0st RAT
GitVenom Malware Steals $456K in Bitcoin Using Fake GitHub Projects to Hijack Wallets
New Linux Malware 'Auto-Color' Grants Hackers Full Remote Access to Compromised Systems
Hundreds of GitHub repos served up malware for years - Help Net Security
Mac malware masks as job interview to steal crypto | Cybernews
‘Auto-Color’ Linux Malware Uses Advanced Stealth Tactics To Evade Detection
Two new pieces of Mac malware in the wild – one being fixed this week
FatalRAT Phishing Attacks Target APAC Industries Using Chinese Cloud Services
Vo1d malware botnet grows to 1.6 million Android TVs worldwide
Chinese-Backed Silver Fox Plants Backdoors in Healthcare Networks - Infosecurity Magazine
New malware disrupts critical industrial processes • The Register
Bots/Botnets
Massive botnet hits Microsoft 365 accounts - Help Net Security
Chinese Botnet Bypasses MFA in Microsoft 365 Attacks - Infosecurity Magazine
Hackers are on a huge Microsoft 365 password spraying spree – here’s what you need to know | ITPro
Vo1d malware botnet grows to 1.6 million Android TVs worldwide
Mobile
Mobile phishing attacks on the rise | SC Media
Forget phishing, now "mishing" is the new security threat to worry about | TechRadar
SpyLend Android malware downloaded 100,000 times from Google Play
Apple currently only able to detect Pegasus spyware in half of infected iPhones
Pegasus Spyware Used Widely to Target Individuals in Private Industry & Finance Sectors
One wrong SMS can wipe your savings, thanks to this Android Trojan | Cybernews
Unmanaged Devices: The Overlooked Threat CISOs Must Confront
New TgToxic Banking Trojan Variant Evolves with Anti-Analysis Upgrades
Security flaw in popular stalkerware apps is exposing phone data of millions | TechRadar
Why this Android image-scanning feature is controversial - and how to get rid of it | ZDNET
A Major Security Flaw Has Been Discovered in Samsung's Secure Folder Feature | Extremetech
Denial of Service/DoS/DDoS
How DDoS Attacks Work and How You Can Protect Your Business From Them - Security Boulevard
Web DDoS attacks up over 500 percent
Radware’s Cyber Threat Report: Web DDoS Attacks Surge 550%
Internet of Things – IoT
Cyber Attacks On EV Chargers Pose A Growing Threat | The Truth About Cars
Vo1d malware botnet grows to 1.6 million Android TVs worldwide
Hackers Can Crack Into Car Cameras in Minutes Flat
Data Breaches/Leaks
Orange Group confirms breach after hacker leaks company documents
Cyber Security's Biggest Blind Spot: Third-Party Risk, New Resilience Analysis Finds
Third parties now dominant cyber-attack point
Background check, drug testing provider DISA suffers data breach - Help Net Security
Hacker Behind Over 90 Data Leaks Arrested in Thailand - SecurityWeek
DISA took a year to disclose a breach affecting 3.3M+ people • The Register
Top digital loan firm security slip-up puts data of 36 million users at risk | TechRadar
Organised Crime & Criminal Actors
B1ack’s Stash released 1 Million credit cards - Security Affairs
Thailand Targets Cyber Sweatshops to Free 1000s of Captives
Microsoft names cyber criminals behind AI deepfake network
INSIGHT: Fraud-as-a-Service: Creating a new breed of fraudsters - AML Intelligence
10 cyber security insights from ex hacker and FBI agent who arrested him
Data: Cyber threats skyrocket as attackers think like businesses | Capacity Media
'Silver Fox' APT Skirts Windows Blocklist in BYOVD Attack
26 New Threat Groups Spotted in 2024: CrowdStrike - SecurityWeek
Hacker Behind Over 90 Data Leaks Arrested in Thailand - SecurityWeek
Leader of cyber blackmail gang faces jail – Court News UK
The evolution of Russian cyber crime | Intel 471
How Anonymous Actually Works, According to a Founding Member - Business Insider
Criminal hacker known as ALTDOS, DESORDEN, GHOSTR and 0mid16B arrested – DataBreaches.Net
US Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason” – Krebs on Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Lazarus Group moves funds to multiple wallets as Bybit offers bounty
Lazarus Group launches ‘QinShihuang’ meme coin to launder $26M more from Bybit stash | Cryptopolitan
AI Tricksters Spin Up Fake DeepSeek Sites to Steal Crypto
Mac malware masks as job interview to steal crypto | Cybernews
Inside the Lazarus Group money laundering strategy
Fake CS2 tournament streams used to steal crypto, Steam accounts
Pump.fun X account hacked to promote scam governance token
DeepSeek-Spoofing Leveraged For Crypto Exfiltration | MSSP Alert
Argentina’s $4.6 Billion Crypto Scandal; Largest-Ever Crypto Theft
Insider Risk and Insider Threats
The Time to Speak to Employees About Insider Risk Is Now
US Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason” – Krebs on Security
Insurance
Insurers still concerned over cyber risk unknowns
Supply Chain and Third Parties
Cyber Security's Biggest Blind Spot: Third-Party Risk, New Resilience Analysis Finds
Third parties now dominant cyber-attack point
Survey: Nearly Half of Data Breaches Involved Third-Party Remote Access - Security Boulevard
Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware
Russia warns financial sector organisations of IT service provider LANIT compromise
Cloud/SaaS
UK backdoor order forces Apple to disable cloud encryption | Digital Trends
Apple Pulls Advanced Data Protection for New UK Users Amid Backdoor Demand - SecurityWeek
Chinese Botnet Bypasses MFA in Microsoft 365 Attacks - Infosecurity Magazine
Are False Positives Killing Your Cloud Security? Veriti Research Reveals - Security Boulevard
The Future of Auditing: What to Look for in 2025 - Security Boulevard
Encryption
Apple Pulls Encrypted iCloud Security Feature in UK Amid Government Backdoor Demands - MacRumors
Government has made UK user data ‘less secure’ with Apple row – experts - LBC
Experts Slam Government After “Disastrous” Apple Encryption Move - Infosecurity Magazine
Public told to use Apple security tool Advanced Data Protection that Home Office tried to crack
Quantum Computing Has Arrived; We Need To Prepare For Its Impact
The encryption backdoor debate: Why are we still here?
The Case for Encryption | Open Rights Group
Google Says Its Encryption Has Not Changed—Does Android Now Beat iPhone?
FBI Warns iPhone, Android Users—We Want ‘Lawful Access’ To All Your Encrypted Data
Signal May Exit Sweden If Government Imposes Encryption Backdoor - Infosecurity Magazine
Privacy tech firms warn France’s encryption and VPN laws threaten privacy
Linux and Open Source
New Linux Malware 'Auto-Color' Grants Hackers Full Remote Access to Compromised Systems
‘Auto-Color’ Linux Malware Uses Advanced Stealth Tactics To Evade Detection
OpenSSF Releases Security Baseline for Open Source Projects - SecurityWeek
Passwords, Credential Stuffing & Brute Force Attacks
Scale of unstoppable info-stealer malware laid bare • The Register
Hackers stole this engineer's 1Password database. Could it happen to you? | ZDNET
Is your email or password among the 240+ million compromised by infostealers? - Help Net Security
3.9 Billion Passwords Stolen—Infostealer Malware Blamed
HaveIBeenPwned Adds 244 Million Passwords Stolen By Infostealers - Infosecurity Magazine
Cisco Details ‘Salt Typhoon’ Network Hopping, Credential Theft Tactics - SecurityWeek
Social Media
As Meta gets rid of fact-checkers, misinformation is going viral | TechCrunch
How new Facebook policies incentivize spreading misinformation | ZDNET
Pump.fun X account hacked to promote scam governance token
Regulations, Fines and Legislation
Government has made UK user data ‘less secure’ with Apple row – experts - LBC
Cyber security Needs to Stay Nonpartisan in the Age of DOGE
House Dems say DOGE is leaving publicly exposed entry points into government systems | CyberScoop
Firing of 130 CISA staff worries cyber security industry | CSO Online
Federal cyber security layoffs could leave U.S. vulnerable to hackers - CBS News
Why we need an expanded CISA to fight today’s cyber threats | SC Media
Gabbard Calls for Investigation of UK’s Apple Backdoor Request
The Future of Auditing: What to Look for in 2025 - Security Boulevard
Trump 2.0 Brings Cuts to Cyber, Consumer Protections – Krebs on Security
Fake video of Trump kissing Musk's toes beamed to federal computers
China compromised GOP emails ahead of Republican convention • The Register
NIST Purge Puts US Semiconductors, AI Safety At Risk
Models, Frameworks and Standards
We must all safeguard against cyber attacks
UK businesses should look to Ireland amid EU cyber security overhaul | Computer Weekly
How To Take Your Firm From Risk To Resilience In 8 DORA-compliant Steps
Careers, Working in Cyber and Information Security
The CISO's dilemma of protecting the enterprise while driving innovation - Help Net Security
The cyber security skills gap reality: We need to face the challenge of emerging tech | CSO Online
Cyber security professionals face expanding responsibilities, with 61% covering multiple domains
Law Enforcement Action and Take Downs
Microsoft names cyber criminals behind AI deepfake network
Hacker Behind Over 90 Data Leaks Arrested in Thailand - SecurityWeek
Leader of cyber blackmail gang faces jail – Court News UK
Criminal hacker known as ALTDOS, DESORDEN, GHOSTR and 0mid16B arrested – DataBreaches.Net
US Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason” – Krebs on Security
Misinformation, Disinformation and Propaganda
As Meta gets rid of fact-checkers, misinformation is going viral | TechCrunch
How new Facebook policies incentivize spreading misinformation | ZDNET
AI-Powered Deception is a Menace to Our Societies
Data Leak Exposes TopSec's Role in China's Censorship-as-a-Service Operations
Opinion | The right-wing media machine hits a wall - The Washington Post
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Aggressive Tactics, Weaponization of AI-powered Deception Rises | Business Wire
The Growing Threat of Cyber Warfare from Nation-States - PaymentsJournal
Nation State Actors
Geopolitical Tension Fuels APT and Hacktivism Surge - Infosecurity Magazine
How APT Naming Conventions Make Us Less Safe
China
FBI Has Warned About 'Ghost' Cyber Attacks. What You Need to Know. - Business Insider
Chinese Botnet Bypasses MFA in Microsoft 365 Attacks - Infosecurity Magazine
A Tale of Two Typhoons: Properly Diagnosing Chinese Cyber Threats - War on the Rocks
CrowdStrike: China hacking has reached 'inflection point' | TechTarget
Chinese APT Uses VPN Bug to Exploit Worldwide OT Orgs
China-linked threat actors stole 10% of Belgian State Security Service (VSSE)'s staff emails
Data Leak Exposes TopSec's Role in China's Censorship-as-a-Service Operations
Cisco Details ‘Salt Typhoon’ Network Hopping, Credential Theft Tactics - SecurityWeek
China compromised GOP emails ahead of Republican convention • The Register
Chinese-Backed Silver Fox Plants Backdoors in Healthcare Networks - Infosecurity Magazine
Russia
The evolution of Russian cyber crime | Intel 471
Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware
Russia warns financial sector organisations of IT service provider LANIT compromise
Cyber Attacks Hits Leading Russian IT Service Provider’s Subsidiaries | MSSP Alert
Russia warns financial sector of major IT service provider hack
Australia Bans Kaspersky Software Over National Security and Espionage Concerns
Apple Cuts Off Russian Developers from Enterprise Program Amid Ongoing Sanctions - gHacks Tech News
Sweden investigates suspected sabotage of undersea telecoms cable - BBC News
Germany takes the fight to Russia in undersea cable war
Drone-Equipped U.S. Marines Now Helping Protect Baltic Sea Submarine Cables
Putin’s secret weapon: The threat to the UK lurking on our sea beds - BBC News
North Korea
Lazarus Group launches ‘QinShihuang’ meme coin to launder $26M more from Bybit stash | Cryptopolitan
FBI Confirms North Korea’s Lazarus Group as Bybyit Hackers - Infosecurity Magazine
Inside the Lazarus Group money laundering strategy
FBI fingers North Korea for $1.5B Bybit cryptocurrency heist • The Register
Lazarus Group moves funds to multiple wallets as Bybit offers bounty
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Modern Approach to Attributing Hacktivist Groups - Check Point Research
How Anonymous Actually Works, According to a Founding Member - Business Insider
Tools and Controls
Cyber criminals prefer remote tools over malware, says CrowdStrike | SC Media
Chinese APT Uses VPN Bug to Exploit Worldwide OT Orgs
Why you can’t afford to botch staff onboarding processes | ITPro
99% of Organisations Report API-Related Security Issues - Infosecurity Magazine
Nations Open 'Data Embassies' to Protect Critical Info
Privacy tech firms warn France’s encryption and VPN laws threaten privacy
Reports Published in the Last Week
CrowdStrike 2025 Global Threat Report: Beware the Enterprising Adversary
Other News
Cyber Attacks Become Increasingly Efficient | MSSP Alert
26 New Threat Groups Spotted in 2024: CrowdStrike - SecurityWeek
SITA report reveals how aviation industry is doubling down on cyber security | Times Aerospace
OpenSSF Releases Security Baseline for Open Source Projects - SecurityWeek
What Netflix's 'Zero Day' Got Right (and Wrong) About Cyber Attacks
Threat Actors Stealing Users Browser Fingerprints To Bypass Security Measures & Impersonate Users
Mounting Threats to Cyber-Physical Systems - Security Boulevard
Manufacturers told beware cyber-attacks as sector becoming rising target
Experts Warn of Maritime Industry’s Cyber Vulnerabilities | AFCEA International
Security and privacy concerns challenge public sector's efforts to modernize - Help Net Security
Nine Threat Groups Active in OT Operations in 2024: Dragos - SecurityWeek
New malware disrupts critical industrial processes • The Register
Vulnerability Management
23 Vulnerabilities in Black Basta's Chat Logs Exploited in Wild
Software Vulnerabilities Take Almost Nine Months to Patch - Infosecurity Magazine
61% of Hackers Use New Exploit Code Within 48 Hours of Attack - Infosecurity Magazine
What is VMaaS? Why You Should Consider Vulnerability-Management-as-a-Service
Misconfigured Access Systems Expose Hundreds Of Thousands Of Employees And Organisations
US Government Supercharges Security Vulnerabilities
Vulnerabilities
Atlassian fixed critical flaws in Confluence and Crowd
Second Recently Patched Flaw Exploited to Hack Palo Alto Firewalls - SecurityWeek
Two Actively Exploited Security Flaws in Adobe and Oracle Products Flagged by CISA
CISA Adds Microsoft and Zimbra Flaws to KEV Catalog Amid Active Exploitation
Cisco Patches Vulnerabilities in Nexus Switches - SecurityWeek
Vulnerabilities in MongoDB Library Allow RCE on Node.js Servers - SecurityWeek
Mac security researchers expose two new exploits | Macworld
Max Severity RCE Vuln in All Versions of MITRE Caldera
Siemens Teamcenter vulnerability could allow account takeover (CVE-2025-23363) - Help Net Security
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.