Security Highlights Of The Day [24/12/25]

Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites
Cybersecurity researchers have discovered two malicious Google Chrome extensions with the same name and published by the same developer that come with capabilities to intercept traffic and capture user credentials. The extensions are advertised as a “multi-location network speed test plug-in” and, once users subscribe, route traffic from more than 170 domains through attacker-controlled infrastructure, enabling large-scale data exfiltration.
Source: The Hacker News

Microsoft Teams Strengthens Messaging Security by Default in January
Microsoft announced that Teams will automatically enable messaging safety features by default starting January 12, 2026, for tenants using default configurations. The update activates protections against weaponizable file types, malicious URLs, and introduces a system for reporting false positives, improving defenses against malicious content shared in chats.
Source: BleepingComputer

Ransomware Hits Romanian Water Authority, 1000 Systems Knocked Offline
Romania’s national water authority is recovering from a ransomware attack that began on December 20, 2025, impacting approximately 1,000 systems, including workstations, email services, and web servers. Authorities classify the incident as a national security concern due to the critical infrastructure role of water management.
Source: Hackread

Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
A critical vulnerability tracked as CVE-2025-68613 has been disclosed in the n8n workflow automation platform. Under specific conditions, expressions supplied during workflow configuration may be evaluated in an insufficiently isolated execution context, potentially leading to arbitrary code execution.
Source: The Hacker News

Zero-Day Alert: Linksys Auth Bypass Lets Hackers Hijack Routers Without Passwords
Researchers disclosed a zero-day vulnerability (CVE-2025-52692) in the Linksys E9450-SG router that allows attackers on the local network to bypass authentication and gain full control of the device. The flaw enables activation of a hidden Telnet service without requiring a password, highlighting ongoing risks in consumer router security.
Source: Security Online

Why the holiday period is the riskiest time for security

The period between Christmas and New Year usually brings slower business operations, reduced staffing, and a focus on keeping only essential processes running. For attackers, this is not downtime. It is an opportunity. Security incidents that begin during the holidays are often not detected immediately, and their full impact becomes visible only after normal operations resume.

Experience from real-world incidents shows that holidays are not an exception but one of the most vulnerable periods of the year. Not because of new or advanced threats, but because existing weaknesses combine with reduced oversight and slower response.

Why attackers target the Christmas and New Year period

Attackers choose timing deliberately. The holiday season creates a predictable environment where organizations operate with limited capacity. It is well known when key employees are on leave, when security teams are understaffed, and when decisions are delayed. In these conditions, attackers gain more time inside systems before being noticed. Even basic intrusions can progress further than usual simply because no one is actively watching.

Decision making also slows down. When suspicious activity is detected, escalation is often delayed due to unclear responsibility or unavailable personnel. This allows attackers to move laterally, collect data, and prepare more damaging stages of an attack.

Fewer people, slower response, relaxed controls

During the holidays, security rarely fails by design. It simply loses priority. IT and security teams often work with reduced coverage, and in smaller organizations security monitoring may be limited to occasional checks. Alerts remain unread, logs are collected but not actively reviewed, and suspicious events are not correlated into a meaningful picture.

At the same time, temporary exceptions become normal. Temporary user accounts remain active, remote access is not reviewed, and security controls are loosened to make remote work easier. These decisions increase the attack surface precisely when the ability to respond is at its weakest.

The most common attacks during the holiday period

Attacks at the end of the year are rarely technically sophisticated. Their success depends on timing and human behavior. Phishing remains the most common attack vector. Messages often imitate delivery notifications, holiday greetings, changes to work schedules, or urgent financial requests before year end. Employees working remotely may not have an easy way to verify such requests, increasing the likelihood of error.

Ransomware attacks frequently begin with compromised accounts or phishing emails, but are executed when attackers believe the organization will respond slowly. Every hour of delay during the holidays increases pressure and potential damage.

Compromised VPN and remote access services are also common. Weak passwords, missing multi-factor authentication, and outdated configurations allow attackers to gain silent access. These intrusions often remain undetected until January, when unusual behavior or a major incident finally surfaces.

In most cases, these are not new vulnerabilities. They are known technical weaknesses that existed long before, but become critical when active monitoring is reduced.

What organizations can realistically do without round-the-clock monitoring

Not every organization has the resources for continuous security monitoring or on-call response teams. That does not mean they are defenseless. The first step is understanding real exposure. Without clear visibility into technical vulnerabilities, it is difficult to know which weaknesses actually matter. This is where a vulnerability assessment becomes essential.

A vulnerability assessment provides a structured overview of weaknesses across systems, applications, and network infrastructure. Instead of assumptions, organizations gain a clear picture of technical gaps that can be exploited during periods of reduced attention.

The second step is prioritization. Not all vulnerabilities carry the same risk. Understanding which issues have the greatest potential impact allows teams to focus limited time and resources where it matters most.

The third step is preparation. Organizations that understand their weaknesses can address critical findings before the holidays and enter the period with lower risk and greater control, even without continuous monitoring.

Holidays do not create problems, they expose them

The holiday season does not cause security incidents by itself. It reveals how effective existing controls really are when daily routines and constant oversight disappear. Organizations with a clear understanding of their technical weaknesses and real risk posture enter the holidays with fewer surprises. Those that rely on assumptions often begin the new year responding to incidents that could have been prevented.

Sources:

FBI & CISA – Ransomware Awareness for Holidays and Weekends (AA21-243A)
Palo Alto Networks Unit 42 – Incident Response Report

If you want to enter the holiday period with a clear understanding of the technical weaknesses in your environment, AresISEC vulnerability assessment helps identify issues before they are exploited when response capability is limited.

Instead of guesswork, you receive concrete findings, an assessment of real risk, and clear remediation guidance tailored to your systems and priorities. Identify vulnerabilities before the holiday slowdown becomes an opportunity for attackers.

Security Highlights Of The Day [23/12/25]

ATM Hackers Using ‘Ploutus’ Malware Charged in US
The US Department of Justice has charged 54 individuals for their involvement in a large-scale ATM jackpotting campaign using the Ploutus malware family. The suspects are linked to the Venezuelan crime syndicate Tren de Aragua and face severe penalties, including decades-long prison sentences, for bank fraud, computer hacking, and money laundering.
Source: SecurityWeek

Hackers Abuse Popular Monitoring Tool Nezha as a Stealth Trojan
Researchers discovered that the open-source monitoring tool Nezha is being repurposed as a Remote Access Trojan (RAT). Because Nezha is legitimate software widely used by administrators and shows zero antivirus detections, attackers are exploiting it to gain persistent, stealthy access to compromised systems.
Source: Hackread

MacSync macOS Malware Distributed via Signed Swift Application
Jamf reports that MacSync Stealer, a macOS information-stealing malware, is now being distributed through a signed Swift application, removing the need for terminal-based execution. The malware has evolved from the earlier Mac.c stealer and now includes full backdoor functionality via a Go-based agent.
Source: SecurityWeek

Critical RCE Flaw Impacts Over 115,000 WatchGuard Firewalls
More than 115,000 internet-exposed WatchGuard Firebox devices remain vulnerable to an actively exploited remote code execution flaw (CVE-2025-14733). Successful exploitation allows unauthenticated attackers to execute arbitrary code, particularly on devices configured with IKEv2 VPN services.
Source: BleepingComputer

ClickFix Used to Deploy Stealc and Qilin Ransomware
Sophos researchers detail how the ClickFix social-engineering technique is being used to deploy Stealc infostealers and facilitate Qilin ransomware attacks. Victims are tricked into following fake human-verification steps on compromised websites, leading to malware installation and later ransomware deployment.
Source: Sophos

Security Highlights Of The Day [22/12/25]

China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware
A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been linked to cyber espionage attacks noted in Southeast Asia and Japan. According to ESET, the group leverages Windows Group Policy to deploy malware across compromised networks and abuses cloud services such as Microsoft OneDrive and Google Drive for command-and-control operations.
Source: The Hacker News

Coordinated Credential-Based Campaign Targets Cisco and Palo Alto Networks VPN Gateways
GreyNoise is tracking a coordinated, automated credential-based campaign targeting enterprise VPN authentication infrastructure, including Cisco SSL VPN and Palo Alto Networks GlobalProtect. The activity consists of large-scale scripted login attempts rather than vulnerability exploitation and appears to be a single campaign pivoting across multiple VPN platforms.
Source: GreyNoise

Lazarus Group Embed New BeaverTail Variant in Developer Tools
Darktrace research has identified a new variant of the JavaScript-based BeaverTail infostealer linked to North Korea’s Lazarus Group. The malware is distributed through fake job offers that lure developers into downloading tools supposedly required for technical interviews, which instead compromise victim systems.
Source: Hackread

Clop Ransomware Targets Gladinet CentreStack in Data Theft Attacks
The Clop ransomware gang is targeting internet-exposed Gladinet CentreStack file servers as part of a new data theft extortion campaign. Attackers are actively scanning for exposed servers, breaching them, and leaving ransom notes, despite previous security updates released by Gladinet to address exploited vulnerabilities.
Source: BleepingComputer

Rust’s First Breach: CVE-2025-68260 Marks the First Rust Vulnerability in the Linux Kernel
A vulnerability tracked as CVE-2025-68260 has been fixed in the Linux kernel, marking the first officially assigned CVE for Rust code in the mainline kernel. The issue affects the Rust-based Android Binder driver and could lead to system crashes due to unsafe concurrent manipulation of linked list elements.
Source: Security Online

Security Highlights Of The Day [08/12/25]

New Wave of VPN Login Attempts Targets Palo Alto GlobalProtect Portals
A large campaign began on December 2, targeting Palo Alto GlobalProtect portals with brute-force attempts and later scanning SonicWall SonicOS API endpoints. The activity originated from over 7,000 IPs tied to hosting provider 3xK GmbH (AS200373), according to GreyNoise.
Source: BleepingComputer

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows
Trend Micro uncovered GhostPenguin, a multithreaded Linux backdoor using RC5-encrypted UDP communications, discovered via AI-driven automated threat hunting. The backdoor supports remote shell access, file operations, and resilient command delivery through synchronized threads.
Source: Trend Micro

China-Linked Warp Panda Targets North American Firms in Espionage Campaign
CrowdStrike reports that Warp Panda is conducting advanced cyber espionage against North American legal, tech and manufacturing firms. The actor demonstrates strong OPSEC and cloud/VM expertise, with observed targeting of VMware vCenter environments in 2025.
Source: Infosecurity Magazine

Over 70 Domains Used in Months-Long Phishing Spree Against US Universities
Infoblox uncovered a months-long phishing operation targeting at least 18 U.S. universities. Attackers used more than 70 domains and bypassed MFA using the Evilginx adversary-in-the-middle toolkit to steal login credentials.
Source: Hackread

Inside Shanya, a Packer-As-A-Service Fueling Modern Attacks
Sophos analyzed Shanya, a new packer-as-a-service tool now favored by ransomware groups, partially replacing HeartCrypt. Shanya supports complex obfuscation and has been used in targeted attacks observed during incident response operations.
Source: Sophos

‘Broadside’ Mirai Variant Targets Maritime Logistics Sector
Cydome researchers identified “Broadside,” a Mirai variant exploiting CVE-2024-3721 in maritime digital recording devices. The flaw enables remote command injection and persistent monitoring via Netlink, threatening global logistics operations.
Source: Dark Reading

Researchers Uncover 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE
Security researcher Ari Marzouk disclosed 30+ vulnerabilities in AI-powered IDEs like Cursor, Windsurf, GitHub Copilot, Roo Code, Zed.dev and others. The flaws, dubbed “IDEsaster,” combine prompt injection with legitimate features to enable data exfiltration and remote code execution.
Source: The Hacker News

Marquis Software Breach Affects Over 780,000 Nationwide
Marquis Software confirmed a breach affecting more than 780,000 individuals after attackers exploited a SonicWall vulnerability to access and exfiltrate sensitive files from its systems. The impacted data included financial and personal information from client institutions.
Source: Infosecurity Magazine

LockBit 5.0 Infrastructure Exposed in New Server, IP, and Domain Leak
Researchers identified LockBit 5.0 infrastructure hosted on 205.185.116.233 and the domain karma0.xyz, both tied to PONYNET. The exposure reveals operational details amid LockBit’s resurgence with upgraded malware capabilities.
Source: Cybersecurity News

AWS: China-Linked Threat Actors Weaponized React2Shell Hours After Disclosure
AWS warns that China-linked threat actors began exploiting the newly disclosed React2Shell vulnerability (CVE-2025-55182) within hours. Although AWS services are unaffected, the flaw impacts organizations running vulnerable React/Next.js deployments.
Source: Security Affairs

Common Technical Mistakes in Preparing for NIS2

The NIS2 Directive introduces broader obligations, stricter technical requirements and significantly higher accountability for entities across the EU. It expands the scope of regulated sectors, strengthens supervisory powers and introduces substantial penalties that can reach up to 10 million euros or 2 percent of global annual revenue. With only 24 hours to submit an initial incident notification and the expectation of demonstrated technical controls, it becomes clear that compliance cannot be achieved through documentation alone.

Organizations that postpone their preparation usually struggle not with policies, but with technical weaknesses: missing visibility, misconfigurations, unmanaged vulnerabilities and insufficient monitoring. These issues surface quickly once NIS2 analysis begins.

Insufficient Technical Controls

Article 21 of the Directive outlines mandatory technical and organizational measures such as vulnerability management, data protection, supply chain security, identity and access management, secure configuration, network monitoring and regular validation of controls. In practice, many organizations rely on basic tools such as antivirus, firewalls and MFA while missing essential elements like continuous monitoring, segmentation and comprehensive logging.

Technical debt accumulated over years cannot be compensated with policies alone. NIS2 expects real operational security, not theoretical security on paper.

Incomplete Asset and Data Inventory

A precise asset inventory is crucial for identifying critical systems, understanding dependencies and assessing risk. NIS2 indirectly requires this through Articles 20 and 21. Many organizations lack full visibility into servers, services, legacy systems, Internet-facing endpoints, APIs and key data flows. Undocumented or abandoned systems often remain exposed without monitoring.

Without an accurate map of assets and data, risk assessments become generic and protective measures are implemented in the wrong places or at the wrong priority.

Poorly Configured or Incomplete Logging

NIS2 places strong emphasis on rapid detection, analysis and reporting of incidents. Article 23 requires an initial notification within 24 hours and a more detailed report within 72 hours. This is not possible without comprehensive and synchronized logging.

Common gaps include missing administrative logs, missing application audit trails, lack of logging on backup systems, insufficient SIEM coverage and no time synchronization. When an incident occurs, organizations often discover they do not have the data required to reconstruct the event or support a timely notification.

Lack of Network Segmentation

Flat networks and broad access rights remain common despite the Directive’s expectation of reduced attack surface and restricted lateral movement. In many environments, critical systems, employee workstations and backup environments still share the same segments, making containment almost impossible.

Proper segmentation, micro-segmentation in virtual environments, strict separation of administrative networks and isolation of backups are essential measures that directly support NIS2 expectations.

Weak Incident Response Preparedness

NIS2 requires structured incident response capabilities, including forensic readiness, early threat detection mechanisms, recovery procedures and scenario testing. Many organizations have incident response plans on paper but lack the technical capabilities to execute them.

Frequent issues include the absence of centralized event visibility, missing playbooks, untested backups, no integrity checks and no tooling for rapid forensic collection. When an incident occurs, the organization is unable to respond within the timelines mandated by Article 23.

Occasional Instead of Continuous Vulnerability Management

Vulnerabilities do not follow audit cycles, yet many organizations perform scans only once or twice a year. NIS2 explicitly requires vulnerability management as a continuous process. Without authenticated scanning, post-patch verification and real-time monitoring of emerging vulnerabilities, organizations remain exposed.

Reports often pile up without prioritization, leaving critical findings unresolved for extended periods.

Overemphasis on User Training Instead of Technical Foundations

User awareness is important, but it cannot replace insufficient technical architecture, poor configuration or missing monitoring capabilities. Some organizations invest heavily in training while leaving the core infrastructure unchanged and vulnerable.

If architecture, administration and monitoring are not adequately implemented, even highly aware users cannot prevent system-wide compromise.

NIS2 is not merely another regulatory requirement but also an opportunity to modernize infrastructure, strengthen operational resilience and introduce structure into security processes. Organizations that start early gain clarity, reduce pressure and avoid last-minute remediation. Those that delay often face simultaneous technical and organizational challenges.

If you need a quiet, structured and practical approach to assessing your security posture or planning your next steps, AresISEC can support you throughout the preparation process. NIS2 may be demanding, but it is also a chance to align security with real operational risks.

Sources:
EUR-Lex – NIS2 Directive (EU) 2022/2555
European Commission – NIS2 Directive Overview
ENISA – NIS Investigation and Guidance
ENISA – Security Measures Under NIS2
European Commission – Digital Strategy: Cybersecurity

If you need support in assessing your NIS2 readiness or planning the next steps, AresISEC can help you strengthen your security posture through a structured and practical approach.

Security Highlights Of The Day [11/11/25]

Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Cybersecurity researchers uncovered a large-scale phishing campaign aimed at the hospitality sector, using ClickFix-style pages to trick hotel managers into deploying PureRAT malware. Attackers leveraged compromised email accounts to impersonate Booking.com and redirect victims to credential-stealing sites. The stolen credentials grant unauthorized access to booking platforms like Booking.com and Expedia, which are then monetized or used for further fraud.
Source: TheHackerNews

Microsoft Uncovers ‘Whisper Leak’ Attack That Identifies AI Chat Topics in Encrypted Traffic
Microsoft researchers discovered a side-channel attack named Whisper Leak, capable of revealing AI chat conversation topics from encrypted traffic. The attack targets streaming-mode language models, allowing adversaries monitoring network traffic—such as nation-state actors or local network observers—to infer user prompt subjects. The discovery raises significant concerns about the privacy of enterprise and user communications with AI systems.
Source: TheHackerNews

QNAP Patches Vulnerabilities Exploited at Pwn2Own Ireland
QNAP Systems released security updates for two dozen vulnerabilities, seven of which were exploited during the Pwn2Own Ireland 2025 hacking competition. Researchers from Team DDOS and DEVCORE demonstrated chained exploits affecting QNAP routers and NAS devices, earning over $140,000 in rewards. The company urges all users to update to HBS 3 Hybrid Backup Sync version 26.2.0.938 and reset passwords after patching.
Source: SecurityWeek

‘Ransomvibing’ Infests Visual Studio Extension Market
A new malicious extension on Visual Studio Marketplace introduces “ransomvibing” — ransomware code generated through AI “vibe coding.” The extension openly encrypts and exfiltrates data, marking a disturbing trend of threat actors leveraging AI tools to create malware via natural language prompts. Researchers warn that as AI-generated code becomes common in development environments, its misuse by cybercriminals will likely increase.
Source: DarkReading

GlassWorm Malware Returns on OpenVSX With 3 New VSCode Extensions
The GlassWorm malware campaign resurfaced on OpenVSX with three new VSCode extensions downloaded over 10,000 times. The malware uses hidden Unicode characters and Solana blockchain transactions to steal credentials and crypto wallet data. In response, OpenVSX revoked access tokens for compromised accounts and implemented stronger security controls to prevent further incidents.
Source: BleepingComputer

Security Highlights Of The Day [10/11/25]

Crossed Wires: A Case Study of Iranian Espionage and Attribution
Proofpoint researchers analyzed an espionage campaign originating from Iran that began with a benign email discussing domestic unrest. The campaign’s tactics overlapped with several Iranian-linked groups, including TA455, TA453, and TA450. Due to the lack of a definitive connection to any specific group, Proofpoint designated the activity as a new temporary cluster, UNK_SmudgedSerpent. The case highlights the complexity of attribution among state-aligned threat actors.
Source: Proofpoint

Industry Attacks Surge, Mobile Malware Spreads: The ThreatLabz 2025 Mobile, IoT & OT Report
Zscaler’s ThreatLabz 2025 report reveals a surge in attacks across mobile, IoT, and OT environments, reflecting their growing interconnection in business infrastructure. Android malware activity increased by 67% year-over-year, with 239 malicious apps downloaded over 42 million times. The Energy, Transportation, and Healthcare sectors saw attack spikes of 387%, 382%, and 224% respectively, driven by advanced spyware and trojans.
Source: Zscaler

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
Palo Alto Networks’ Unit 42 uncovered a new Android spyware family named LANDFALL, exploiting zero-day CVE-2025-21042 in Samsung’s image processing library. The spyware was delivered through malicious DNG image files sent via WhatsApp and was actively exploited in the wild before Samsung issued a patch in April 2025. The attack chain resembles previous Apple and WhatsApp exploits, indicating a broader pattern in cross-platform spyware distribution.
Source: Unit 42 (Palo Alto Networks)

November 2025 Patch Tuesday Forecast: Windows Exchange Server EOL?
HelpNetSecurity’s Patch Tuesday forecast highlights Microsoft’s record number of fixes for October 2025, addressing 250 CVEs across Windows 10 and 11. With end-of-life support ending for several enterprise editions and older Office and Exchange Server versions, Microsoft urges organizations to migrate to supported platforms. The final update for Windows 11 23H2 Professional arrives next week, while Education and Enterprise editions will be supported until November 2026.
Source: HelpNetSecurity

Tracking a Dragon: Investigating a DragonForce-affiliated Ransomware Attack with Darktrace
Darktrace investigated a ransomware attack linked to DragonForce affiliates targeting the manufacturing sector. The attackers used credential brute-forcing, data exfiltration, and file encryption. Analysis of Windows Registry artifacts revealed manipulation of scheduled tasks and WMI security settings, indicating persistence techniques. The findings demonstrate the sophistication of DragonForce-linked ransomware operations.
Source: Darktrace

Security Highlights Of The Day [07/11/25]

ClickFix Malware Attacks Evolve With Multi-OS Support, Video Tutorials
The ClickFix malware campaign has advanced with new features including multi-OS support, embedded video tutorials guiding victims through infection, and system auto-detection for tailored payload execution. Previously, attackers relied on written instructions to trick users into executing malicious code, but now they use convincing videos to enhance credibility. The goal remains to deploy information stealers and other malware through deceptive social-engineering tactics.
Source: BleepingComputer

Critical Cisco UCCX Flaw Lets Attackers Run Commands as Root
Cisco patched a critical flaw (CVE-2025-20354) in its Unified Contact Center Express (UCCX) platform that could allow unauthenticated attackers to execute commands with root privileges. The vulnerability, located in the Java RMI process, was reported by security researcher Jahmel Harris. Cisco also addressed a separate flaw in its CCX Editor application that could allow attackers to bypass authentication and execute arbitrary scripts remotely with administrative rights.
Source: BleepingComputer

SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
SonicWall confirmed that state-sponsored actors were responsible for the September breach that exposed firewall configuration backup files. The attackers accessed the backups via an API call from a specific cloud environment. While the company emphasized that the incident was unrelated to Akira ransomware attacks, it did not name the nation behind the activity. The breach affected less than 5% of SonicWall customers using the cloud backup service.
Source: TheHackerNews

From Tabletop to Turnkey: Building Cyber Resilience in Financial Services
The financial sector is now required to conduct cyber resilience exercises due to global regulatory mandates such as DORA in the EU and CPS230 in Australia. These tabletop exercises, once optional, have become an operational necessity. The complexity of compliance lies in cross-functional collaboration, combining technical and non-technical teams to meet resilience standards and strengthen organizational preparedness.
Source: TheHackerNews

Nevada Ransomware Attack Started Months Before It Was Discovered, Per Report
An after-action report revealed that Nevada’s August ransomware attack began as early as May 2025, when a state employee unknowingly downloaded malicious software. The incident disrupted critical services including licensing, employment checks, and payroll operations. Recovery efforts cost the state at least $1.5 million, though officials confirmed no ransom was paid. The attack underscores the growing threat of ransomware to state-level infrastructure.
Source: SecurityWeek

Security Highlights Of The Day [06/11/25]

Beating XLoader at Speed: Generative AI as a Force Multiplier for Reverse Engineering
Check Point Research highlights how generative AI is revolutionizing malware analysis, enabling researchers to rapidly decode and understand complex malware like XLoader. Traditionally, XLoader’s multiple encryption layers, obfuscation, and fake C2 domains made it one of the hardest malware families to reverse-engineer. With generative AI, analysts can now identify algorithms, generate decryption tools, and uncover indicators of compromise in hours rather than days, significantly improving response speed.
Source: Check Point Research

Exploiting Microsoft Teams: Impersonation and Spoofing Vulnerabilities Exposed
New research from Check Point reveals that Microsoft Teams contained vulnerabilities allowing attackers to impersonate executives, manipulate messages, and spoof notifications. The flaws could be exploited by malicious insiders or external guest users, fundamentally compromising trust in corporate communications. Attackers could appear as high-level executives or alter message histories without detection, exposing major risks for organizations that rely heavily on Teams for collaboration and decision-making.
Source: Check Point Research

GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools
Google’s Threat Intelligence Group (GTIG) reports that adversaries have moved beyond using AI for efficiency — they are now deploying AI-enabled malware capable of adapting in real time. The “AI Threat Tracker” update shows both state-backed and cybercriminal groups integrating machine learning into attacks, enhancing evasion and persistence. The findings reflect an operational shift toward dynamic, self-modifying AI-driven threats across the attack lifecycle.
Source: Google Cloud

Software Supply Chain Attacks Surge to Record High in October 2025
According to Cyble, software supply chain attacks reached record levels in October 2025 — up 30% from the previous peak in April. Threat actors claimed 41 attacks during the month, doubling the average monthly activity from early 2024. The surge is linked to zero-day exploits and increased targeting of SaaS and IT service providers. Cyble warns that elevated activity levels indicate sustained long-term risk, with AI-powered phishing and cloud threats further fueling the trend.
Source: Cyble

South Africa Launches Pilot for Secure Data Exchange Among Government Agencies
South Africa has launched “MzansiXchange,” a pilot initiative enabling secure data exchange between government departments. Led by the National Treasury, the system aims to eliminate data silos and improve public-sector efficiency by allowing real-time collaboration and informed decision-making. Rather than centralizing information, MzansiXchange acts as a secure bridge between authorized entities, promoting interoperability and transparency in governance.
Source: Cyble

Author: AresISEC Security Team