Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Intelligence Briefing 28 November 2025
Black Arrow Cyber Threat Intelligence Briefing 28 November 2025:
-M&A Risk: Ransomware Hackers Attack SMBs Being Acquired to Try and Gain Access to Multiple Companies
-CrowdStrike Catches Insider Feeding Information to Hackers
-A Third of Workers Risk Cyber Security Breach by Using Work Devices for Personal Use
-Shadow AI Security Breaches Will Hit 40% of All Companies by 2030, Warns Gartner
-New (ISC)2 Report Finds That Vendor Security Gaps Threaten Critical Infrastructure and Supply Chains
-A Fake Windows Update Screen Is Fooling Windows Users into Installing Malware
-FBI: Cybercriminals Stole $262 Million by Impersonating Bank Support Teams Since January
-Compromised Credentials Responsible for 50% of Ransomware Attacks
-Russian and North Korean Hackers Form Alliances
-Alliances Between Ransomware Groups Tied to Recent Surge in Cybercrime
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week we start with an alert on the cyber security risks of mergers and acquisitions: attackers are found to have entered the networks of companies that are later acquired by another organisation, allowing the attackers to enter the acquiring organisation also.
We highlight insider-risks that business leaders should be aware of, including employees who are bribed by attackers, employees using work devices for personal use, and employees using shadow AI. Attacker tactics in this week’s review include attacks via third parties, fake Windows update screens, impersonating the support teams of banks, and using compromised credentials to inflict ransomware attacks. We also see greater collaboration and alliances by attacker groups.
A key part of building stronger cyber security and resilience is understanding how attackers are evolving their tactics. This threat intelligence empowers you to objectively assess how your organisation is susceptible to these tactics and what you need to do to enhance your own security. We strongly recommend that threat intelligence should feature in your leadership training, your incident response exercise and your governance papers; contact us to discuss how we can help you achieve this in a proportionate way.
Top Cyber Stories of the Last Week
M&A Risk: Ransomware Hackers Attack SMBs Being Acquired to Try and Gain Access to Multiple Companies
Research describes how ransomware actors focus on smaller firms that are likely acquisition targets. By compromising SonicWall devices and leaving backdoors in place, the attackers can pivot into larger enterprises once deals complete, often without the parent organisation realising these assets exist. The pattern underlines the importance of thorough asset discovery, credential hygiene and security reviews before and immediately after acquisitions.
CrowdStrike Catches Insider Feeding Information to Hackers
CrowdStrike confirmed that a now terminated insider secretly shared screenshots of internal systems with cyber attackers called the Scattered Lapsus$ Hunters collective. The hackers say they agreed to pay $25,000 and claim they briefly obtained SSO authentication cookies, but CrowdStrike reports no breach of its systems or customer data. The incident is now with law enforcement and highlights the impact of insider risks faced by organisations.
A Third of Workers Risk Cyber Security Breach by Using Work Devices for Personal Use
A survey of 1,000 Irish office workers finds 31% use work devices for personal tasks, with 32% clicking suspicious links and 22% accessing sensitive documents over public Wi-Fi. High risk behaviour includes 26% entering company data into AI tools, 33% using unauthorised tools and 19% sharing work passwords. Despite this, 73% feel confident spotting cyber threats and 54% in their password security, although 23% of organisations suffered a cyber security breach in the past year and 32% of workers do not receive regular training.
Source: https://businessplus.ie/news/cyber-security-work-devices-personal-use/
Shadow AI Security Breaches Will Hit 40% of All Companies by 2030, Warns Gartner
Gartner warns that 40% of organisations could suffer security breaches through shadow AI by 2030. Staff routinely paste documents or data into unapproved AI tools, risking exposure of customer records, salary information, source code and strategic plans. Surveys cited include one where 90% of security leaders admit using unapproved AI tools and 71% of UK employees do the same. Gartner advises clear AI policies, audits for unsanctioned usage and provision of approved tools with training.
Source: https://www.fortra.com/blog/shadow-ai-security-breaches-will-hit-40-companies-2030-warns-gartner
New (ISC)2 Report Finds That Vendor Security Gaps Threaten Critical Infrastructure and Supply Chains
An (ISC)2 study finds many organisations are worried about supplier risk yet are slow to manage it. Respondents report frequent security deficiencies in vendors, including weak identity controls, lack of compliance certifications and inadequate monitoring. Nearly a third experienced incidents linked to suppliers, yet many only review vendor security annually. The report urges continuous assessment, clearer contractual expectations and closer collaboration across procurement, legal and security teams.
Source: https://www.helpnetsecurity.com/2025/11/25/isc2-vendor-security-gaps-report/
A Fake Windows Update Screen Is Fooling Windows Users into Installing Malware
Researchers uncovered a new ClickFix campaign where full screen fake Windows Update or captcha pages trick users into pasting attacker supplied commands copied to their clipboard. The commands fetch PNG images that hide malware within pixel data, which a .NET Stego Loader decrypts and runs in memory. The attack includes software that runs 10,000 fake functions to hinder analysis by experts.
FBI: Cybercriminals Stole $262 Million by Impersonating Bank Support Teams Since January
The FBI warns that scammers posed as bank support staff in more than 5,100 complaints since January 2025, stealing around $262 million. Criminals convince victims to grant remote access, reveal credentials or approve transactions, then drain accounts or move funds into cryptocurrency. Tactics include spoofed phone numbers, fake support sites and search engine poisoning, prompting the FBI to urge customers to verify contact details and banks to harden customer authentication.
Compromised Credentials Responsible for 50% of Ransomware Attacks
Beazley Security’s Q3 2025 Threat Report shows ransomware surged in August and September, accounting for 26% and 18% of incidents. Akira, Qilin and INC Ransomware made up 65% of cases. The most common entry point was valid compromised credentials used to access VPNs, ahead of exploitation of internet facing systems. SonicWall vulnerabilities were heavily abused, with stolen configuration files expected to fuel future targeted attacks.
Source: https://natlawreview.com/article/compromised-credentials-responsible-50-ransomware-attacks
Russian and North Korean Hackers Form Alliances
Researchers say Russian group Gamaredon and North Korea’s Lazarus Group are collaborating by sharing infrastructure and tools, including command and control servers and the InvisibleFerret malware family. The partnership combines Russian espionage targeting with North Korean financially motivated operations, including past thefts of billions in crypto assets. Analysts warn this alignment could make both campaigns harder to attribute and disrupt.
Source: https://cybersecuritynews.com/russian-and-north-korean-hackers-form-alliances/
Alliances Between Ransomware Groups Tied to Recent Surge in Cybercrime
Data shows a 41% rise in ransomware attacks between September and October, with the ransomware group Qilin responsible for 29% of October incidents, followed by Sinobi and Akira. Ransomware groups such as LockBit 5.0, DragonForce and Qilin are forming alliances that share tools, infrastructure and reputations. North America suffered 62% of attacks, and more than 200 ransomware variants have been seen this year.
Governance, Risk and Compliance
UK cyber attacks will inevitably increase, HP boss warns
A third of workers risk cybersecurity breach by using work devices for personal use
Cybersecurity Is Now a Core Business Discipline - SecurityWeek
Ministers send small businesses cyber threat warning - UKTN
SolarWinds dismissed: what the SEC’s U-turn signals for cyber enforcement | A&O Shearman - JDSupra
Government publishes independent study revealing cost of cyber attacks to UK economy
Political instability is now the defining force behind global business risk | theHRD
Empathy key weapon in cyber fight
We must protect our society against tomorrow's cyber threats - GOV.UK
Root causes of security breaches remain elusive — jeopardizing resilience | CSO Online
Cyber demand grows following high-profile attacks - Insurance Post
UK Budget 2025: Reactions From Tech Leaders - TechRepublic
3 ways CISOs can win over their boards this budget season | CSO Online
The CISO’s greatest risk? Department leaders quitting | CSO Online
Selling to the CISO: An open letter to the cybersecurity industry | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Akira ransomware crew infected enterprise systems during M&A • The Register
Russia-linked crooks bought themselves a bank for Christmas • The Register
Get ready for 2026, the year of AI-aided ransomware • The Register
Compromised Credentials Responsible for 50% of Ransomware Attacks - Beazley
Alliances between ransomware groups tied to recent surge in cybercrime | CSO Online
Scattered Spider alleged members deny TfL charges
Ransomware Attacks Remaking Cyber as National Priority
Ransomware gangs seize a new hostage: your AWS S3 buckets | CSO Online
Scattered Lapsus$ Hunters stress testing Zendesk weak spots • The Register
Piecing Together the Puzzle: A Qilin Ransomware Investigation
Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim 'Korean Leaks' Data Heist
Hackers come for big British retailers | The Observer
UK car production plummets 24% in wake of JLR cyber attack | Autocar
Should we ban ransom payments to cyber attackers?
Ransomware Victims
Akira ransomware crew infected enterprise systems during M&A • The Register
Scattered Spider alleged members deny TfL charges
UK car production plummets 24% in wake of JLR cyber attack | Autocar
Crisis24 shuts down emergency notification system in wake of ransomware attack | CyberScoop
Canon Says Subsidiary Impacted by Oracle EBS Hack - SecurityWeek
Asahi Data Breach Impacts 2 Million Individuals - SecurityWeek
Scottish council still reeling from 2023 ransomware attack • The Register
Report warns councils after 2023 Western Isles cyber-attack | The Herald
NCSC called in as London councils grapple with cyber attacks | IT Pro
London Cyberattacks Confirmed — Security Experts Issue Multiple Warnings
Lessons From the European Airports Ransomware Attack | Lawfare
Phishing & Email Based Attacks
Email blind spots are back to bite security teams - Help Net Security
ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen
Advanced Security Isn't Stopping Old Phishing Tactics
Hackers Replace 'm' with 'rn' in Microsoft(.)com to Steal Users' Login Credentials
Microsoft cracks down on malicious meeting invites - Help Net Security
Phishing Breaks More Defenses Than Ever. Here’s the Fix
Other Social Engineering
ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen
A fake Windows Update screen is fooling Windows users into installing malware
FBI: Cybercriminals stole $262M by impersonating bank support teams
Microsoft cracks down on malicious meeting invites - Help Net Security
JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers
RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware
Fraud, Scams and Financial Crime
FBI: Cybercriminals stole $262M by impersonating bank support teams
Criminal networks industrialize payment fraud operations - Help Net Security
Scammers hacked her phone and stole thousands of pounds - how did they get her details? - BBC News
AI Arms Race: How to Stay Ahead of Generative AI-Powered Fraud | MSSP Alert
New legislation targets scammers that use AI to deceive | CyberScoop
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Did Myanmar’s Junta Demolish Scam Centers Just for Show? - The New York Times
Artificial Intelligence
Shadow AI Security Breaches will hit 40% of all Companies by 2030, Warns Gartner | Fortra
Get ready for 2026, the year of AI-aided ransomware • The Register
Underground AI models promise to be hackers ‘cyber pentesting waifu’ | CyberScoop
Vibe coding feels magical, but it can sink your business fast - here's how | ZDNET
'Dark LLMs' Aid Petty Criminals, Underwhelm Technically
How Malware Authors Incorporate LLMs to Evade Detection
Anthropic's new warning: If you train AI to cheat, it'll hack and sabotage too | ZDNET
Emerging threat from deepfakes leads to cybersecurity arms race | SC Media
Think your password is safe? AI could break it before you blink - BetaNews
AI Arms Race: How to Stay Ahead of Generative AI-Powered Fraud | MSSP Alert
New legislation targets scammers that use AI to deceive | CyberScoop
New research finds that Claude breaks bad if you teach it to cheat | CyberScoop
Four charged with plotting to sneak Nvidia chips into China • The Register
Google's AI is now snooping on your emails - here's how to opt out | ZDNET
CISOs Get Real About Hiring in the Age of AI
Prompt Injections Loom Large Over ChatGPT Atlas Browser
2FA/MFA
Germany urges default 2FA for webmail providers | Cybernews
Malware
A fake Windows Update screen is fooling Windows users into installing malware
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
How Malware Authors Incorporate LLMs to Evade Detection
JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers
Cybercriminals Exploit Browser Push Notifications to Deliver Malware - Infosecurity Magazine
BadAudio malware: How APT24 scaled its cyberespionage through supply chain attacks
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Operation Endgame disrupts Rhadamanthys information-stealing malware
DPRK’s FlexibleFerret Tightens macOS Grip
RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware
WSUS RCE Exploit Used to Deploy ShadowPad Backdoor
Bots/Botnets
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
Mobile
New CISA alert: encryption isn't what's failing on Signal and WhatsApp | TechSpot
CISA Warns of Active Spyware Campaigns Hijacking High-Value Signal and WhatsApp Users
Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications | CISA
Scammers hacked her phone and stole thousands of pounds - how did they get her details? - BBC News
Internet of Things – IoT
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
Aircraft cabin IoT leaves vendor and passenger data exposed - Help Net Security
Data Breaches/Leaks
The breaches everyone gets hit by (and how to stop them) - Help Net Security
JPMorgan, Citi, Morgan Stanley Client Data May Be Exposed by Vendor's Hack, NYT Reports
Gainsight Expands Impacted Customer List Following Salesforce Security Alert
OpenAI data may have been exposed after a cyberattack on analytics firm Mixpanel
Iberia discloses customer data leak after vendor security breach
Council had ‘gaps in cybersecurity’ before ransomware attack
Cox Enterprises discloses Oracle E-Business Suite data breach
183 Million Credentials Misreported as a Gmail Breach - Security Boulevard
Russian and North Korean hackers steal 2TB of data from South Korean banks - Cryptopolitan
Canon Says Subsidiary Impacted by Oracle EBS Hack - SecurityWeek
Asahi Data Breach Impacts 2 Million Individuals - SecurityWeek
Kensington and Chelsea Council cyber attack sees emergency plans initiated - BBC News
NCSC called in as London councils grapple with cyber attacks | IT Pro
US car parts dealer allegedly hit by massive breach | Cybernews
Organised Crime & Criminal Actors
Criminal networks industrialize payment fraud operations - Help Net Security
Ministers send small businesses cyber threat warning - UKTN
Government publishes independent study revealing cost of cyber attacks to UK economy
'Dark LLMs' Aid Petty Criminals, Underwhelm Technically
Alice Guo: Philippines jails 'Chinese spy mayor' for life - BBC News
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Did Myanmar’s Junta Demolish Scam Centers Just for Show? - The New York Times
Insider Risk and Insider Threats
A third of workers risk cybersecurity breach by using work devices for personal use
Cybersecurity giant CrowdStrike fires insider working with hackers - Cryptopolitan
Human risk: don’t blame the victim, fix the system | TechRadar
Why legal firms must confront insider cyber threats - Tech Monitor
Empathy key weapon in cyber fight
Supply Chain and Third Parties
JPMorgan, Citi, Morgan Stanley Client Data May Be Exposed by Vendor's Hack, NYT Reports
Gainsight Expands Impacted Customer List Following Salesforce Security Alert
Iberia discloses customer data leak after vendor security breach
BadAudio malware: How APT24 scaled its cyberespionage through supply chain attacks
Supply chain sprawl is rewriting security priorities - Help Net Security
Cox Enterprises discloses Oracle E-Business Suite data breach
Google security experts say Gainsight hacks may have left hundreds of companies affected | TechRadar
Canon Says Subsidiary Impacted by Oracle EBS Hack - SecurityWeek
Software Supply Chain
UK Report Proposes Liability For Software Provider Insecurity - Infosecurity Magazine
Cloud/SaaS
New ShadowV2 botnet malware used AWS outage as a test opportunity
Botnet takes advantage of AWS outage to smack 28 countries • The Register
ToddyCat's New Hacking Tools Steal Outlook Emails and Microsoft 365 Access Tokens
MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants
Ransomware gangs seize a new hostage: your AWS S3 buckets | CSO Online
How has cloud flipped the regular security narrative? – Computerworld
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
Outages
Internet failure highlighted connected risk – Russell
Encryption
New CISA alert: encryption isn't what's failing on Signal and WhatsApp | TechSpot
Cheap Device Bypasses AMD, Intel Memory Encryption
Quantum encryption is pushing satellite hardware to its limits - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Compromised Credentials Responsible for 50% of Ransomware Attacks - Beazley
DPRK’s FlexibleFerret Tightens macOS Grip
Hackers Replace 'm' with 'rn' in Microsoft(.)com to Steal Users' Login Credentials
Social data puts user passwords at risk in unexpected ways - Help Net Security
Think your password is safe? AI could break it before you blink - BetaNews
183 Million Credentials Misreported as a Gmail Breach - Security Boulevard
Social Media
Social data puts user passwords at risk in unexpected ways - Help Net Security
Influencers in the crosshairs: How cybercriminals are targeting content creators
Regulations, Fines and Legislation
Should we ban ransom payments to cyber attackers?
Mounting Cyber-Threats Prompt Calls For Economic Security Bill - Infosecurity Magazine
Key provisions of the UK Cyber Resilience Bill Revealed - Infosecurity Magazine
SolarWinds dismissed: what the SEC’s U-turn signals for cyber enforcement | A&O Shearman - JDSupra
The Internet Is on Fire and the FCC Just Walked Away With the Extinguisher
Rights groups accuse ICO of ‘collapse in enforcement activity’
UK data regulator under pressure after failing to regulate public sector effectively - Neowin
NIS2 Directive Explained: Part 2 – Management Bodies Rules | DLA Piper - JDSupra
New legislation targets scammers that use AI to deceive | CyberScoop
Four charged with plotting to sneak Nvidia chips into China • The Register
UK Report Proposes Liability For Software Provider Insecurity - Infosecurity Magazine
Switching to Offense: US Makes Cyber Strategy Changes
Powers to protect us from cyber attacks ‘go too far’
Mobile industry warns patchwork regs are driving up costs • The Register
New York Hospital Cyber Rules to 'Raise the Bar' Nationwide
Models, Frameworks and Standards
Key provisions of the UK Cyber Resilience Bill Revealed - Infosecurity Magazine
NIS2 Directive Explained: Part 2 – Management Bodies Rules | DLA Piper - JDSupra
Data Protection
Rights groups accuse ICO of ‘collapse in enforcement activity’
UK data regulator under pressure after failing to regulate public sector effectively - Neowin
Careers, Working in Cyber and Information Security
Invisible battles: How cybersecurity work erodes mental health | CSO Online
CISOs Get Real About Hiring in the Age of AI
The CISO’s greatest risk? Department leaders quitting | CSO Online
Law Enforcement Action and Take Downs
Operation Endgame disrupts Rhadamanthys information-stealing malware
'Scattered Spider' teens plead not guilty to UK transport hack
Russian Suspected of Cyberattacks on Polish and EU Companies Detained in Krakow - Militarnyi
Alice Guo: Philippines jails 'Chinese spy mayor' for life - BBC News
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’ | WIRED
Did Myanmar’s Junta Demolish Scam Centers Just for Show? - The New York Times
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
BadAudio malware: How APT24 scaled its cyberespionage through supply chain attacks
Polish minister warns of ongoing 'cyberwar' with Russia - TRT World
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
With Friends Like These: China Spies on Russian IT Orgs
As Space Becomes Warfare Domain, Cyber Is on the Frontlines
Security is not only military—it is societal. Something worth learning from the Scandinavians
Nation State Actors
Political instability is now the defining force behind global business risk | theHRD
Switching to Offense: US Makes Cyber Strategy Changes
China
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
With Friends Like These: China Spies on Russian IT Orgs
Four charged with plotting to sneak Nvidia chips into China • The Register
Alice Guo: Philippines jails 'Chinese spy mayor' for life - BBC News
Russia
Polish minister warns of ongoing 'cyberwar' with Russia - TRT World
Russia-linked crooks bought themselves a bank for Christmas • The Register
Russian and North Korean Hackers Form Alliances to Attack Organizations Worldwide
China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services
With Friends Like These: China Spies on Russian IT Orgs
Russian Suspected of Cyberattacks on Polish and EU Companies Detained in Krakow - Militarnyi
Russian and North Korean hackers steal 2TB of data from South Korean banks - Cryptopolitan
Iran
Iranian APT hacks helped direct missile strikes in Israel and the Red Sea | CSO Online
North Korea
Russian and North Korean Hackers Form Alliances to Attack Organizations Worldwide
DPRK’s FlexibleFerret Tightens macOS Grip
Russian and North Korean hackers steal 2TB of data from South Korean banks - Cryptopolitan
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Political instability is now the defining force behind global business risk | theHRD
Security is not only military—it is societal. Something worth learning from the Scandinavians
Tools and Controls
Advanced Security Isn't Stopping Old Phishing Tactics
Root causes of security breaches remain elusive — jeopardizing resilience | CSO Online
MS Teams Guest Access Can Remove Defender Protection When Users Join External Tenants
Vibe coding feels magical, but it can sink your business fast - here's how | ZDNET
Recognizing and responding to cyber threats: What differentiates NDR, EDR and XDR | CSO Online
3 ways CISOs can win over their boards this budget season | CSO Online
Security teams want automation but 96 percent face problems implementing it - BetaNews
Other News
Vehicle Hackers Continue Outpacing Cybersecurity Efforts, Expert Says
This tiny Windows shortcut file is a bigger security threat than you think
Ex-CISA officials, CISOs aim to stop the spread of hacklore • The Register
This campaign aims to tackle persistent security myths in favor of better advice | CyberScoop
We must protect our society against tomorrow's cyber threats - GOV.UK
Legacy web forms are the weakest link in government data security | CyberScoop
Vulnerability Management
Around 500 million PCs are holding off upgrading to Windows 11, says Dell | The Verge
Fragmented tooling slows vulnerability management - Help Net Security
What happens when vulnerability scores fall apart? - Help Net Security
Vulnerabilities
SonicWall Patches High-Severity Flaws in Firewalls, Email Security Appliance - SecurityWeek
Akira's SonicWall Hacks Are Taking Down Large Enterprises
ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Critical Vulnerability in Azure Bastion Let Attackers Bypass Authentication and Escalate privileges
Critical Oracle Identity Manager Flaw Under Attack
WSUS RCE Exploit Used to Deploy ShadowPad Backdoor
Prompt Injections Loom Large Over ChatGPT Atlas Browser
ASUS warns of new critical auth bypass flaw in AiCloud routers
CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability
Microsoft: Out-of-band update fixes Windows 11 hotpatch install loop
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 21 November 2025
Black Arrow Cyber Threat Intelligence Briefing 21 November 2025:
-The Trojan Prompt: How GenAI Is Turning Staff Into Unwitting Insider Threats
-Copy And Paste Cyber Security Warning — 99% Of Enterprises Now At Risk
-Google: Threat Groups Will Accelerate Their Use of AI in 2026
-“We’ve Seen a 30% Increase in Successful Email Scams in the Last Two Years”
-“We Are Moments Before the First Real Cyberwar, One in Which Not a Single Shot Is Fired”
-Our Industries Are Vulnerable to Cyber Attacks: Boardrooms Must Prioritize Resilience, Not Reaction
-Overconfidence Is the New Cyber Risk: Immersive’s 2025 Cyber Workforce Benchmark Report Exposes a Global Readiness Illusion
-The Hidden Cost of a Hack: Unpacking the Ripple Effect of Cybercrime
-Half of Ransomware Access Due to Hijacked VPN Credentials
-Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites
-UK Targets Russian Cyber Gang as £14.7 Billion Attacks Hit British Economy
-Cyber-enabled Kinetic Targeting: Iran-linked Actor Uses Cyber Operations to Support Physical Attacks
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week, we have reviewed several articles in the specialist and general media about the risks presented by AI, in particular generative AI. These include employees pasting sensitive information into public tools, and attackers exploiting the functionality of GenAI such as using Claude to almost completely carry out a cyber espionage operation against organisations. Our review also highlights that the more traditional attack vectors remain a risk for organisations, including hijacked VPNs, weak password controls, and phishing.
Our message to business leaders is clear and unchanged, and supported by various sources included in our review this week: Boards must ensure they have a realistic assessment of their readiness to deal with a cyber attack. It is particularly important that business leaders should be part of the readiness and should not consider the response to be IT focused. This requires an upskilled leadership team to command and govern their cyber security; contact us for details of how we support organisations to achieve this in a proportionate way.
Top Cyber Stories of the Last Week
The Trojan Prompt: How GenAI Is Turning Staff into Unwitting Insider Threats
Two evolving risks are emerging relating to generative AI. The first, a “Trojan prompt”, is where staff paste sensitive documents, credentials or API keys into public GenAI tools which often fall outside monitoring by traditional cyber security data loss prevention and monitoring controls. The second is the “Imprompter” attack, where hidden instructions in prompts harvest personal data with close to an 80% success rate. A robust response to these combines clear GenAI governance, user education and hardware level zero trust on endpoints that inspects when data is accessed on the device’s drive itself.
Copy And Paste Cyber Security Warning — 99% Of Enterprises Now at Risk
LayerX’s Browser Security Report finds that sensitive data now often leaves enterprises through copy and paste rather than file uploads. Findings show that 77% of employees paste data into AI tools and 46% into file storage, frequently outside IT control. Browser extensions amplify the risks, with 99% of enterprise users having at least one installed, more than half holding high or critical permissions. 26% are installed outside normal channels (sideloaded), creating major blind spots for security teams.
Google: Threat Groups Will Accelerate Their Use of AI in 2026
Anthropic’s research shows China linked attackers using the generative AI engine Claude to carry out around 80% to 90% of a cyber espionage operation against about 30 organisations, with humans stepping in only at key decision points. Meanwhile, Google’s Cybersecurity Forecast 2026 expects threat groups to adopt AI across reconnaissance, exploitation and malware development, while AI enabled tools can also reshape how cyber security teams defend the organisation.
Source: https://www.msspalert.com/news/google-threat-groups-will-accelerate-their-use-of-ai-in-2026
“We’ve Seen a 30% Increase in Successful Email Scams in the Last Two Years”
Data from At Bay, which insures about 40,000 businesses, shows a 30% increase in successful email scams over two years as attackers use AI to craft convincing, personalised messages. Traditional email security struggles with this variety and speed. Organisations are urged to move towards context aware detection, scrutinise how AI agents are integrated into systems and recognise the new attack surfaces created by rapid AI adoption.
Source: https://www.calcalistech.com/ctechnews/article/lsncr0rtd
“We Are Moments Before the First Real Cyberwar, One in Which Not a Single Shot Is Fired”
The Director General of Israel’s National Cyber Directorate describes three stages of AI and cyber convergence: using AI for cyber defence, protecting AI systems themselves and a future AI versus AI phase where autonomous agents conduct both attacks and defence. Israel is cited as one of the most targeted countries globally. AI driven campaigns are expected to be capable of digitally besieging states, even as constant pressure will force defences to improve.
Source: https://www.calcalistech.com/ctechnews/article/askx8c3bj
Our Industries Are Vulnerable to Cyber Attacks: Boardrooms Must Prioritize Resilience, Not Reaction
A new report by Accenture indicates the challenge faced by organisations defending against AI driven threats. It finds that 88% of UK firms lack the maturity needed as AI accelerates ransomware, deepfakes and data theft. Cyber security is presented as a people and reputation issue as much as a technical one. Boards should embed security into strategy, build cross functional crisis preparations and design business continuity for critical services.
Source: https://www.infosecurity-magazine.com/opinions/boardrooms-must-prioritize/
Overconfidence Is the New Cyber Risk: Immersive’s 2025 Cyber Workforce Benchmark Report Exposes a Global Readiness Illusion
Immersive’s 2025 Cyber Workforce Benchmark Report finds that 94% of organisations feel ready for a major incident, yet in the simulated attacks only 22% of the decisions made were appropriate and average containment times are around 29 hours. Only 41% of organisations involve non technical teams in simulations, leaving a significant readiness gap.
The Hidden Cost of a Hack: Unpacking the Ripple Effect of Cybercrime
Beazley’s risk and resilience research with 3,500 leaders shows 29% of executives now rank cyber as their greatest threat, up from 26% in 2024. The findings highlight that business leaders may not fully appreciate the full lifecycle of incidents, including legal actions, regulatory scrutiny and long term reputational harm. Boards should plan for extended disruption and financial ripple effects, not only initial recovery.
Half of Ransomware Access Due to Hijacked VPN Credentials
Beazley Security reports that ransomware incidents increased in Q3 2025, with Akira, Qilin and INC responsible for about 65% of cases and leak posts rising 11% quarter on quarter. Valid VPN credentials provided initial access in 48% of breaches, up from 38% in Q2, while external service exploits accounted for 23%. Infostealers and credential stuffing attacks against SonicWall SSL VPNs feature heavily, reinforcing the need for phishing resistant MFA, conditional access and continuous vulnerability management.
Source: https://www.infosecurity-magazine.com/news/half-ransomware-access-hijacked/
Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites
Socura and Flare’s “FTSE 100 for Sale” report identifies about 460,000 compromised credentials associated with FTSE 100 staff across cybercrime sites. More than 70,000 credentials relate to financial services, and 28,000 appear in infostealer logs, roughly 280 per company. Weak password practices such as “password” and obvious reuse of passwords persist, underscoring the need for strong policies, phishing resistant MFA, conditional access and proactive leak monitoring.
Source: https://www.infosecurity-magazine.com/news/half-million-stolen-ftse-100/
UK Targets Russian Cyber Gang as £14.7 Billion Attacks Hit British Economy
Sanctions against a cyber crime infrastructure / hosting provider called Media Land and its leader Alexander Volosovik target a Russian hosting provider accused of supporting ransomware, phishing and other criminal campaigns against UK organisations. Cyber attacks are estimated to have cost UK businesses about £14.7 billion in 2024, roughly 0.5% of GDP. The move builds on earlier actions against groups such as Evil Corp and LockBit, aiming to disrupt broader Russia based cyber crime ecosystems.
Source: https://www.easterneye.biz/uk-cybercrime-russian-attack-british-economy/
Cyber-enabled Kinetic Targeting: Iran-linked Actor Uses Cyber Operations to Support Physical Attacks
Amazon’s threat intelligence research describes how Iran-aligned actors integrate cyber operations with physical strikes in what it calls ‘cyber enabled kinetic targeting’. The attack group called Imperial Kitten reportedly accessed a ship’s tracking platform and onboard CCTV before an attempted attack on the same vessel by a Houthi missile. Another group, MuddyWater, is linked to compromised cameras in Israel that were then used to support missile strikes, showing how hacked sensors and live data can guide battlefield decisions.
Governance, Risk and Compliance
Organizations overconfident in dealing with cybersecurity incidents - BetaNews
Holyrood | Everyone’s a target: The importance of cybersecurity in a fast changing world
The growing risks presented by cyber security and data breaches – The Irish News
The hidden cost of a hack: Unpacking the ripple effect of cybercrime | Insurance Business America
Resilience At Risk: Talent and Governance in the Age of AI - Infosecurity Magazine
The realities of CISO burnout and exhaustion | CyberScoop
SEC to Drop Controversial SolarWinds Cyberattack Lawsuit
Unpreparedness for risks a worry for CEOs: Kroll Chief Jacob Silverman - The Economic Times
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns
Half of Ransomware Access Due to Hijacked VPN Credentials - Infosecurity Magazine
Russian money launderers bought a bank to disguise ransomware profit | Computer Weekly
The Akira Playbook: How Ransomware Groups Are Weaponizing MFA Fatigue - Security Boulevard
UK's New Cybersecurity Bill Takes Aim at Ransomware Gangs and State-Backed Hackers | Fortra
UK cyber ransom ban risks collapse of essential services
The ransomware payment debate: what it means for organizations | TechRadar
'The Gentlemen' Ransomware Group with Dual-Extortion Strategy Encrypts and Exfiltrates Data
Akira ransomware expands to Nutanix AHV, raising stakes for enterprise security | CSO Online
Cat’s Got Your Files: Lynx Ransomware – The DFIR Report
Ransomware Victims
Oracle Allegedly Breached by Clop Ransomware via E-Business Suite 0-Day Hack
Checkout.com snubs hackers after data breach, to donate ransom instead
Jaguar Land Rover confirms major disruption and £196M cost from September cyberattack
Logitech confirms data breach after Clop extortion attack
Hackers Allegedly Claim Leak of LG Source Code, SMTP, and Hardcoded Credentials
The Washington Post reveals thousands impacted via Oracle-based hack | Cybernews
Everest Ransomware Group Allegedly Exposes 343 GB of Sensitive Data in Major Under Armour Breach
Cornerstone staffing ransomware attack leaks 120,000 resumes, claims Qilin gang | Cybernews
Hacker claims to steal 2.3TB data from Italian rail group, Almaviva
Phishing & Email Based Attacks
Beware! How AI is writing phishing emails that look real | PCWorld
AI Is Supercharging Phishing: Here’s How to Fight Back - SecurityWeek
Beware of Phishing Emails as Spam Filter Alerts Steal Your Email Logins in a Blink
Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real | Malwarebytes
Sneaky2FA PhaaS kit now uses redteamers' Browser-in-the-Browser attack
“We've seen a 30% increase in successful email scams in the last two years” | Ctech
The Tycoon 2FA Phishing Platform and the Collapse of Legacy MFA
Other Social Engineering
Copy And Paste Cybersecurity Warning — 99% Of Enterprises Now At Risk
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
The long conversations that reveal how scammers work - Help Net Security
The Akira Playbook: How Ransomware Groups Are Weaponizing MFA Fatigue - Security Boulevard
Five plead guilty to helping North Koreans infiltrate US firms
Five admit helping North Korea evade sanctions through IT worker schemes
DoJ nets five guilty pleas in Pyongyang’s IT-worker hustle • The Register
US: Five Plead Guilty in North Korean IT Worker Fraud Scheme - Infosecurity Magazine
Almost five-fold increase in reports of online investment ad scams
Convenience culture is breaking personal security - Help Net Security
Scammers sent 166,000 scam texts to NY residents this week in major hack | Mashable
Fraud, Scams and Financial Crime
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
The long conversations that reveal how scammers work - Help Net Security
Don't get ghost tapped: 5 ways to block thieves from scanning your wallet | ZDNET
Almost five-fold increase in reports of online investment ad scams
Convenience culture is breaking personal security - Help Net Security
“We've seen a 30% increase in successful email scams in the last two years” | Ctech
BitQueen jailed as chancellor eyes up her seized £5bn wealth
AI scams surge: how consumers and businesses can stay safe | TechRadar
AI powering transnational crime as Asian gangs move into Pacific - Nikkei Asia
Online safety ‘getting worse’, warns former UK cyber security agency boss | The Standard
Payroll Pirates - Network of Criminal Groups Hijacking Payroll Systems
GenAI and Deepfakes Drive Digital Forgeries and Biometric Fraud - Infosecurity Magazine
UNC2891 Money Mule Network Reveals Full Scope of ATM Fraud Operation - Infosecurity Magazine
Scammers sent 166,000 scam texts to NY residents this week in major hack | Mashable
US announces new strike force targeting Chinese crypto scammers
Artificial Intelligence
Gartner: 40% of Firms to Be Hit By Shadow AI Security Incidents - Infosecurity Magazine
Beware! How AI is writing phishing emails that look real | PCWorld
AI Is Supercharging Phishing: Here’s How to Fight Back - SecurityWeek
Chinese spies used Claude to break into critical orgs • The Register
China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work | CyberScoop
AI chatbots can now execute cyberattacks almost on their own | Vox
What the Anthropic Report on AI Espionage Means for Security Leaders - Intezer
Anthropic Has Some Key Advice for Businesses in the Aftermath of a Massive AI Cyberattack
The Trojan Prompt: How GenAI is Turning Staff into Unwitting Insider Threats - Security Boulevard
Could years of AI conversations be your biggest security blind spot? | IT Pro
How attackers use patience to push past AI guardrails - Help Net Security
Dark LLMs Are Targeting MSPs’ Customers | MSSP Alert
AI Is Supercharging Disinformation Warfare | Foreign Affairs
Google: Threat Groups Will Accelerate Their Use of AI in 2026 | MSSP Alert
“We are moments before the first real cyberwar, one in which not a single shot is fired | Ctech
Convenience culture is breaking personal security - Help Net Security
AI powering transnational crime as Asian gangs move into Pacific - Nikkei Asia
Shadow AI: the next frontier of unseen risk | TechRadar
Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
Microsoft Warns Windows 11 AI Can Install Malware
GenAI and Deepfakes Drive Digital Forgeries and Biometric Fraud - Infosecurity Magazine
Foreign Spies Deploying AI in Cyberattacks | Newsmax.com
Agentic AI puts defenders on a tighter timeline to adapt - Help Net Security
How AI can magnify your tech debt - and 4 ways to avoid that trap | ZDNET
Don't ignore the security risks of agentic AI - SiliconANGLE
Cursor Issue Paves Way for Credential-Stealing Attacks
2FA/MFA
The Akira Playbook: How Ransomware Groups Are Weaponizing MFA Fatigue - Security Boulevard
Attackers are using “Sneaky 2FA” to create fake sign-in windows that look real | Malwarebytes
The Tycoon 2FA Phishing Platform and the Collapse of Legacy MFA
Malware
Microsoft Warns Windows 11 AI Can Install Malware
SilentButDeadly - Network Communication Blocker Tool That Neutralizes EDR/AV
North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels
Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT
New npm Malware Campaign Redirects Victims to Crypto Sites - Infosecurity Magazine
Google exposes BadAudio malware used in APT24 espionage campaigns
Why ‘AI-Powered’ Cyber-Attacks Are Not a Serious Threat …Yet - Infosecurity Magazine
LLM-generated malware improving, but not operational (yet) • The Register
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
Google Finds New Malware Backdoors Linked to Iran
Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks
Bots/Botnets
Largest Azure DDoS Attack Powered by Aisuru Botnet - SecurityWeek
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
Mobile
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
Multi-threat Android malware Sturnus steals Signal, WhatsApp messages
Budget Samsung phones shipped with unremovable spyware, say researchers | Malwarebytes
WhatsApp easily exposed 3.5 billion people's phone numbers - GSMArena.com news
CTM360 Exposes a Global WhatsApp Hijacking Campaign: HackOnChat
WhatsApp 'Eternidade' Trojan Worms Through Brazil
NSO Group argues WhatsApp injunction threatens existence, future U.S. government work | CyberScoop
Denial of Service/DoS/DDoS
Microsoft Mitigates Record 15.72 Tbps DDoS Attack Driven by AISURU Botnet
Internet of Things – IoT
Cybersecurity risks inside the powertrain: why EVs need defence at the motor level - Just Auto
Data Breaches/Leaks
Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites - Infosecurity Magazine
Schools share blame for PowerSchool mega-hack, say watchdogs • The Register
MoD ‘knew using Excel was risky before Afghan data leak’
Hackers Allegedly Claim Leak of LG Source Code, SMTP, and Hardcoded Credentials
The Washington Post reveals thousands impacted via Oracle-based hack | Cybernews
Everest Ransomware Group Allegedly Exposes 343 GB of Sensitive Data in Major Under Armour Breach
WhatsApp easily exposed 3.5 billion people's phone numbers - GSMArena.com news
Major Urssaf cyberattack in France affects 1.2 million Pajemploi users
Eurofiber admits crooks swiped data from French unit • The Register
Pentagon and soldiers let too many secrets slip on socials • The Register
Organised Crime & Criminal Actors
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
AI powering transnational crime as Asian gangs move into Pacific - Nikkei Asia
Online safety ‘getting worse’, warns former UK cyber security agency boss | The Standard
Payroll Pirates - Network of Criminal Groups Hijacking Payroll Systems
British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News
Dutch police takes down bulletproof hosting hub linked to 80+ cybercrime cases
CISA Issues New Guidance on Bulletproof Hosting Threat - Infosecurity Magazine
UNC2891 Money Mule Network Reveals Full Scope of ATM Fraud Operation - Infosecurity Magazine
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island - SecurityWeek
South Korean man sentenced to prison for sending $16K to North Korean hacker | NK News
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
What to Know About the Billion-Dollar Scam Center Industry - The New York Times
BitQueen jailed as chancellor eyes up her seized £5bn wealth
Europol Operation Disrupts $55m in Cryptocurrency for Piracy - Infosecurity Magazine
Wind farm worker sentenced after turning turbines into a secret crypto mine
New npm Malware Campaign Redirects Victims to Crypto Sites - Infosecurity Magazine
Security researcher calls BS on Coinbase breach timeline • The Register
US announces new strike force targeting Chinese crypto scammers
Insider Risk and Insider Threats
The Trojan Prompt: How GenAI is Turning Staff into Unwitting Insider Threats - Security Boulevard
Rogue techie pleads guilty in $862K employer attack • The Register
Wind farm worker sentenced after turning turbines into a secret crypto mine
The Password Was ‘Password’: Why Humans Keep Breaking the Internet
Insurance
What insurers really look at in your identity controls - Help Net Security
Supply Chain and Third Parties
Dark LLMs Are Targeting MSPs’ Customers | MSSP Alert
Cloud/SaaS
Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses
Cloudflare hit by outage affecting Global Network services
And so this is how a tiny Cloudflare update broke huge chunks of the internet | TechSpot
Outages
Cloudflare hit by outage affecting Global Network services
And so this is how a tiny Cloudflare update broke huge chunks of the internet | TechSpot
The internet isn't free: Shutdowns, surveillance and algorithmic risks - Help Net Security
Identity and Access Management
What insurers really look at in your identity controls - Help Net Security
Encryption
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
Dozens of groups call for governments to protect encryption | CyberScoop
Linux and Open Source
5 reasons Kaspersky releasing a Linux antivirus product worries me
Passwords, Credential Stuffing & Brute Force Attacks
Half of Ransomware Access Due to Hijacked VPN Credentials - Infosecurity Magazine
Half a Million Stolen FTSE 100 Credentials Found on Criminal Sites - Infosecurity Magazine
The Password Was ‘Password’: Why Humans Keep Breaking the Internet
The world's most popular passwords are pretty unsurprising - surely we can do better? | TechRadar
Zoomers are officially worse at passwords than 80-year-olds • The Register
Cursor Issue Paves Way for Credential-Stealing Attacks
Social Media
British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News
Convenience culture is breaking personal security - Help Net Security
Pentagon and soldiers let too many secrets slip on socials • The Register
Regulations, Fines and Legislation
UK's New Cybersecurity Bill Takes Aim at Ransomware Gangs and State-Backed Hackers | Fortra
UK cyber ransom ban risks collapse of essential services
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
Dozens of groups call for governments to protect encryption | CyberScoop
SEC to Drop Controversial SolarWinds Cyberattack Lawsuit
Cyber Operations on Domestic Networks Redux | Lawfare
CISA 2015 Receives Extension - Infosecurity Magazine
ENISA Is Now a CVE Program Root - DataBreachToday
Models, Frameworks and Standards
The UK’s Proposed Cyber Security and Resilience Bill | Hogan Lovells - JDSupra
Careers, Working in Cyber and Information Security
Resilience At Risk: Talent and Governance in the Age of AI - Infosecurity Magazine
Learning Sales Skills Make Security Pros More Effective
The retail sector needs a cybersecurity talent incubator | CyberScoop
Law Enforcement Action and Take Downs
Rogue techie pleads guilty in $862K employer attack • The Register
British hacker must repay £4m after hijacking celebrity Twitter accounts - BBC News
Wind farm worker sentenced after turning turbines into a secret crypto mine
BitQueen jailed as chancellor eyes up her seized £5bn wealth
Europol Operation Disrupts $55m in Cryptocurrency for Piracy - Infosecurity Magazine
Dutch police takes down bulletproof hosting hub linked to 80+ cybercrime cases
UNC2891 Money Mule Network Reveals Full Scope of ATM Fraud Operation - Infosecurity Magazine
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island - SecurityWeek
US announces new strike force targeting Chinese crypto scammers
South Korean man sentenced to prison for sending $16K to North Korean hacker | NK News
What are the potential punishments and risks of owning a 'dodgy firestick'? | The Standard
Europol Leads Takedown of Thousands of Extremist Gaming Links - Infosecurity Magazine
Misinformation, Disinformation and Propaganda
AI Is Supercharging Disinformation Warfare | Foreign Affairs
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
“We are moments before the first real cyberwar, one in which not a single shot is fired | Ctech
Russia preparing for war against NATO says top General
U.S. Space Force launches new triad of jammers to disrupt Chinese and Russian satellites
UK will not tolerate Chinese spying, minister says after MI5 alert - BBC News
MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn - SecurityWeek
Countries use cyber targeting to plan strikes: Amazon CSO • The Register
Google exposes BadAudio malware used in APT24 espionage campaigns
Iranian Hackers Launch 'SpearSpecter' Spy Operation on Defense & Government Targets
Nation State Actors
“We are moments before the first real cyberwar, one in which not a single shot is fired | Ctech
Countries use cyber targeting to plan strikes: Amazon CSO • The Register
UK's New Cybersecurity Bill Takes Aim at Ransomware Gangs and State-Backed Hackers | Fortra
Foreign Spies Deploying AI in Cyberattacks | Newsmax.com
Palo Alto CEO tips nations to weaponize quantum by 2029 • The Register
Take fight to the enemy, US cyber boss says • The Register
China
Chinese spies used Claude to break into critical orgs • The Register
China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work | CyberScoop
What the Anthropic Report on AI Espionage Means for Security Leaders - Intezer
AI doesn't just assist cyberattacks anymore - now it can carry them out | ZDNET
Chinese Nation-State Groups Hijacking Software Updates
UK will not tolerate Chinese spying, minister says after MI5 alert - BBC News
MI5 Warns Lawmakers That Chinese Spies Are Trying to Reach Them via LinkedIn - SecurityWeek
Foreign Spies Deploying AI in Cyberattacks | Newsmax.com
U.S. Space Force launches new triad of jammers to disrupt Chinese and Russian satellites
Google exposes BadAudio malware used in APT24 espionage campaigns
Germany lines up new powers to fend off Chinese tech – POLITICO
New WrtHug campaign hijacks thousands of end-of-life ASUS routers
TP-Link accuses rival Netgear of 'smear campaign' • The Register
US announces new strike force targeting Chinese crypto scammers
Russia
Russia preparing for war against NATO says top General
Countries use cyber targeting to plan strikes: Amazon CSO • The Register
UK, US and Australia Sanction Russian Bulletproof Hoster Media Land - Infosecurity Magazine
UK hits Russian cyber gang as £14.7 billion attacks damage economy | EasternEye
U.S. Space Force launches new triad of jammers to disrupt Chinese and Russian satellites
Russian money launderers bought a bank to disguise ransomware profit | Computer Weekly
Russian Hacking Suspect Wanted by the FBI Arrested on Thai Resort Island - SecurityWeek
Russia keeps cutting mobile internet, and people are getting fed up - The Washington Post
Iran
Cyber-enabled kinetic targeting: Iran-linked actor uses cyber operations to support physical attacks
Iranian Hackers Launch 'SpearSpecter' Spy Operation on Defense & Government Targets
Iran's Cyber Objectives: What Do They Want?
Google Finds New Malware Backdoors Linked to Iran
Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks
North Korea
US: Five Plead Guilty in North Korean IT Worker Fraud Scheme - Infosecurity Magazine
North Korean Hackers Turn JSON Services into Covert Malware Delivery Channels
South Korean man sentenced to prison for sending $16K to North Korean hacker | NK News
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Europol Leads Takedown of Thousands of Extremist Gaming Links - Infosecurity Magazine
Tools and Controls
Half of Ransomware Access Due to Hijacked VPN Credentials - Infosecurity Magazine
Palo Alto kit sees massive surge in malicious activity • The Register
Agentic AI puts defenders on a tighter timeline to adapt - Help Net Security
Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage | CyberScoop
5 reasons Kaspersky releasing a Linux antivirus product worries me
SilentButDeadly - Network Communication Blocker Tool That Neutralizes EDR/AV
Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT
Vibe coding to vibe hacking: securing software in the AI era | TechRadar
Resilience At Risk: Talent and Governance in the Age of AI - Infosecurity Magazine
VPN Ban—iPhone And Android ‘Privacy Nightmare’ Is Coming True
What insurers really look at in your identity controls - Help Net Security
Cursor Issue Paves Way for Credential-Stealing Attacks
CISO pay is on the rise, even as security budgets tighten | CIO Dive
Other News
Palo Alto kit sees massive surge in malicious activity • The Register
Schools share blame for PowerSchool mega-hack, say watchdogs • The Register
The internet isn't free: Shutdowns, surveillance and algorithmic risks - Help Net Security
Initial Access Brokers (IAB) in 2025 - From Dark Web Listings to Supply Chain Ransomware Events
Hospitals in the cyber crosshairs - POLITICO
Cyber Operations on Domestic Networks Redux | Lawfare
Black Friday as retailers face cyber surge
TV streaming piracy service with 26M yearly visits shut down
Vulnerability Management
Chinese Nation-State Groups Hijacking Software Updates
Threat group reroutes software updates through hacked network gear - Help Net Security
Can a Global, Decentralized System Save CVE Data?
ENISA Is Now a CVE Program Root - DataBreachToday
Cyber Agency Warns of Government Exploits - DevX
Vulnerabilities
Fortinet finally cops to critical bug under active exploit • The Register
Fortinet Discloses Second Exploited FortiWeb Zero-Day in a Week - SecurityWeek
New SonicWall SonicOS flaw allows hackers to crash firewalls
Fortinet’s delayed alert on actively exploited defect put defenders at a disadvantage | CyberScoop
Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
7-Zip RCE flaw (CVE-2025-11001) actively exploited in attacks in the wild
SolarWinds Patches Three Critical Serv-U Vulnerabilities - SecurityWeek
ASUS warns of critical auth bypass flaw in DSL series routers
Google fixed the seventh Chrome zero-day in 2025
W3 Total Cache WordPress plugin vulnerable to PHP command injection
CVE-2025-50165: Critical Flaw in Windows Graphics Component - Security Boulevard
New WrtHug campaign hijacks thousands of end-of-life ASUS routers
ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts
Millions of sites at risk from Imunify360 critical flaw exploit
RondoDox expands botnet by exploiting XWiki RCE bug left unpatched since February 2025
D-Link warns of new RCE flaws in end-of-life DIR-878 routers
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 14 November 2025
Black Arrow Cyber Threat Intelligence Briefing 14 November 2025:
-Microsoft Teams’ New “Chat With Anyone” Feature Exposes Users To Phishing and Malware Attacks
-Chinese Spies Told Claude To Break Into About 30 Critical Orgs. Some Attacks Succeeded
-5 Reasons Why Attackers Are Phishing Over LinkedIn
-Cyber Insurers Paid Out Over Twice as Much for UK Ransomware Attacks Last Year
-Large Organisations Aren’t Paying Ransomware Threats Anymore: SMBs Are
-FBI: Akira Gang Has Received Nearly $250 Million in Ransoms
-Companies Forced to Make Financial Changes After a Cyberattack
-Cyberattack Impact on Employees May Be as Serious as Technical Fallout
-UK’s New Cyber Security and Resilience Bill Targets Weak Links in Critical Services
-Spy Boss Says Authoritarian Nations Ready to Commit ‘High Impact Sabotage’
-Online Age Checking Is Creating a Treasure Trove of Data for Hackers
-Google Play Store Hosted 239 Malicious Apps That Were Downloaded 40 Million Times
-Android Malware Steals Your Card Details and PIN to Make Instant ATM Withdrawals
Executive Summary
We start this week with alerts on emerging attacks for business leaders and employees to act on. A new feature in Microsoft Teams gives attackers an easier route into organisations, while a leading developer of advanced AI systems has found hostile actors using its AI model to conduct real attacks. We also report how LinkedIn is used to bypass corporate email defences through direct, trusted-looking messages.
Once in, whether through these channels or others, attackers continue to deploy ransomware. Small and medium sized organisations are particularly targeted, and we highlight how incidents affect victims both financially and at a human level.
New cyber legislation is being introduced in the UK, while other countries warn of evolving nation-state threats. We also note the unintended consequences of regulatory requirements, where online age-verification data has created valuable targets for attackers. Finally, we flag malware risks in mobile phone applications found even in approved online stores.
Organisations need to understand developments in cyber security and take steps to strengthen resilience. Contact us to discuss how to do this proportionately and pragmatically.
Top Cyber Stories of the Last Week
Microsoft Teams’ New “Chat With Anyone” Feature Exposes Users To Phishing and Malware Attacks
A new feature in Microsoft Teams lets anyone initiate chats using only an email address, expanding opportunities for phishing and malicious file sharing. Commentators warn that attackers may bypass email defences and impersonate legitimate contacts. Administrators can disable the capability, and the piece recommends pairing configuration changes with training and MFA.
Source: https://cybersecuritynews.com/microsoft-teams-chat-with-anyone-feature/
Chinese Spies Told Claude To Break Into About 30 Critical Orgs. Some Attacks Succeeded
Anthropic identified a Chinese state linked group using its AI model Claude to support intrusions into around 30 high value organisations. Human operators directed strategy, while AI assisted with reconnaissance and coding tasks. The case shows growing attempts to blend human oversight with automated tools to streamline intrusions.
Source: https://www.theregister.com/2025/11/13/chinese_spies_claude_attacks/
5 Reasons Why Attackers Are Phishing Over LinkedIn
LinkedIn phishing is rising as attackers exploit direct messaging to bypass email defences. Compromised accounts from infostealer logs are used to impersonate real professionals, especially in finance and tech. The platform enables easy reconnaissance of roles and access levels. Commentators recommend better browser controls and monitoring of non email channels.
Source: https://www.bleepingcomputer.com/news/security/5-reasons-why-attackers-are-phishing-over-linkedin/
Cyber Insurers Paid Out Over Twice as Much for UK Ransomware Attacks Last Year
A steep rise in ransomware events has driven cyber insurance payouts up by 230%. Insurers report more destructive attacks and increased scrutiny of controls such as patching, backups and incident response before granting cover. While insurance supports recovery, it cannot replace core cyber security hygiene or resilience measures.
Source: https://www.theregister.com/2025/11/11/ransomware_surge_fuels_230_increase/
Large Organisations Aren’t Paying Ransomware Threats Anymore: SMBs Are
Proton, a privacy and security technology provider, reports a shift in attacker focus towards SMBs as large enterprises become less willing to pay. Median ransom payments dropped sharply, while unpatched vulnerabilities remained a leading cause of compromise. SMBs face rising exposure and should prioritise staff awareness, backups and segmentation to limit attacker movement and reduce impact.
Source: https://proton.me/blog/ransomware-threats-smbs
FBI: Akira Gang Has Received Nearly $250 Million in Ransoms
The Akira ransomware group has collected an estimated $244 million since 2023, mainly targeting small and medium sized organisations across multiple sectors. Attackers often exploit weak VPNs, stolen credentials and password spraying, then remove security tools and steal data rapidly. Authorities warn that Akira’s speed and use of legitimate remote access tools demand tighter monitoring and faster patching.
Source: https://therecord.media/akira-gang-received-million
Companies Forced to Make Financial Changes After a Cyberattack
A survey of firms hit by cyberattacks found that 70% of publicly traded companies adjusted earnings or guidance afterwards and 68% saw their stock price affected. Among privately held businesses, 73% diverted budgets away from innovation and growth. Additionally, 92% reported legal, regulatory or compliance consequences such as fines or lawsuits. The research emphasises that recovery from an attack involves far more than restoring systems; it demands financial and strategic overhaul.
Source: https://betanews.com/2025/11/10/companies-forced-to-make-financial-changes-after-a-cyberattack/
Cyberattack Impact on Employees May Be as Serious as Technical Fallout
A survey of 500 Irish businesses found 40% suffered an attack in the past year, with many reporting burnout, stress and increased sick leave. Some saw improved loyalty, but most faced financial harm and ransomware pressures. The report also found that AI related vulnerabilities are rising, yet firms still see AI as beneficial overall.
UK’s New Cyber Security and Resilience Bill Targets Weak Links in Critical Services
Proposed cyber security legislation in the UK will expand existing regulations to include MSPs, data centres and other essential suppliers. It introduces stricter security duties, 24 hour incident reporting and tougher enforcement powers. Operators of critical services would be required to notify impacted customers quickly and maintain stronger controls across supply chains.
Source: https://www.helpnetsecurity.com/2025/11/12/uk-cyber-security-and-resilience-bill/
Spy Boss Says Authoritarian Nations Ready to Commit ‘High Impact Sabotage’
Australia’s domestic intelligence and national security agency, ASIO, warns that hostile states are preparing for cyber sabotage targeting critical infrastructure. Officials cite recent probes by groups such as Volt Typhoon and Salt Typhoon. The director general urges boards to understand their operational dependencies and prepare for scenarios involving communications, power or water disruptions.
Source: https://www.theregister.com/2025/11/12/asio_cyber_sabotage_warnings/
Online Age Checking Is Creating a Treasure Trove of Data for Hackers
Age verification systems increasingly require photo IDs, selfies and credit card checks, creating sensitive data stores attractive to criminals. Breaches at Discord and the Tea app exposed large volumes of imagery and identity data despite policies stating minimal retention. The article argues that regulators lack sufficient power to enforce deletion, especially when third parties are offshore.
Google Play Store Hosted 239 Malicious Apps That Were Downloaded 40 Million Times
Researchers found 239 malicious Android apps on Play, totalling around 42 million downloads. Threats included spyware, banking trojans and adware, with detections rising 67% year on year. Google is tightening developer checks, but observers argue that serious malware continues to slip through, leaving users exposed.
Android Malware Steals Your Card Details and PIN to Make Instant ATM Withdrawals
A malware strain known as NGate records NFC payment data and PINs, allowing criminals to emulate victims’ cards at cash machines. It spreads through phishing and fake banking apps. Users are advised to avoid unsolicited downloads, use trusted app stores and deploy mobile security tools to reduce risk.
Governance, Risk and Compliance
The quiet revolution: How regulation is forcing cybersecurity accountability | CyberScoop
Nearly £200 million paid in cyber claims to help UK businesses recover | ABI
Cyberattack impact on employees may be as serious as technical fallout
Three quarters of SMEs unprotected against everyday risks - CIR Magazine
Companies forced to make financial changes after a cyberattack - BetaNews
The changing language of cyber: communicating with the board | IT Pro
Why Cybersecurity Must Shift To Continuous Incident Response
The Professionalised World of Cybercrime and the New Arms Race - Security Boulevard
Cyberattacks forcing businesses to correct financial outlooks - CIR Magazine
AI is forcing boards to rethink how they govern security - Help Net Security
Cyber Execs Get Insurance, Legal Counsel Perks Amid Higher Risks
CISOs: More Pressure from Internal Expectations than External Threats | MSSP Alert
CISOs are cracking under pressure - Help Net Security
To get funding, CISOs are mastering the language of money - Help Net Security
Reducing the risk of major cyber incidents in the UK through digital resilience | UKAuthority
Threats
Ransomware, Extortion and Destructive Attacks
Qilin Ransomware Activity Surges as Attacks Target Small Businesses - Infosecurity Magazine
Are SMBs facing increasing ransomware threats? | Proton
Ransomware fuels 230% increase in UK cyber insurance payouts • The Register
Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware
Cyberattacks 'costing the UK economy £14.7 billion' a year
Kraken ransomware benchmarks systems for optimal encryption choice
FBI: Akira gang has received nearly $250 million in ransoms | The Record from Recorded Future News
FBI calls Akira ‘top five’ ransomware variant out of 130 targeting US businesses | CyberScoop
'Ransomvibing' Infests Visual Studio Extension Market
Yanluowang initial access broker pleaded guilty to ransomware attacks
How a CPU spike led to uncovering a RansomHub ransomware attack
Russian Hacking Group Sandworm Deploys New Wiper Malware in Ukraine - Infosecurity Magazine
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
The ransomware payment ban: what’s the potential impact for UK businesses? | TechRadar
Russian pleads guilty, staring at 53 years and $9.2M penalty - Cryptopolitan
Ransomware Victims
Allianz UK confirms Oracle EBS compromise • The Register
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site - SecurityWeek
Synnovis Finally Issues Breach Notification After 2024 Ransomware Atta - Infosecurity Magazine
Hackers claim to leak Collins Aerospace data | Cybernews
UK economic growth slows due to cyberattack at Jaguar Land Rover
UK NHS Named in Clop Gang's Exploits of Oracle Zero-Days
Bank of England says JLR's cyberattack damaged UK GDP growth • The Register
Washington Post data breach impacts nearly 10K employees, contractors
Government not handing ‘free money’ to JLR after cyber attack, minister insists | Insider Media
GlobalLogic Becomes Latest Cl0p Victim After Oracle EBS Attack - Infosecurity Magazine
Ransomed CTO falls on sword, refuses to pay extortion demand • The Register
DoorDash hit by new data breach in October exposing user information
Phishing & Email Based Attacks
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
5 reasons why attackers are phishing over LinkedIn
AI and phishing: a toxic pair | Professional Security Magazine
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
New Phishing Attack Leverages Popular Brands to Harvest Login Credentials - Cyber Security News
Google Looks to Dim 'Lighthouse' Phishing Kit
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Cyberattacks 'costing the UK economy £14.7 billion' a year
Other Social Engineering
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
Attackers upgrade ClickFix with tricks used by online stores - Help Net Security
ClickFix Attacks Against macOS Users Evolving - SecurityWeek
What is FileFix — a ClickFix variation? | Kaspersky official blog
ClickFix may be the biggest security threat your family has never heard of - Ars Technica
5 reasons why attackers are phishing over LinkedIn
Phishers target 5K Facebook advertisers with fake biz pages • The Register
Beware the 'Hi, how are you?' text. It's a scam - here's how it works | ZDNET
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Wanna bet? Scammers are playing the odds better than you are - Help Net Security
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Google goes after massive phishing enterprise behind those spammy USPS messages - Neowin
Fraud, Scams and Financial Crime
Cyberattacks 'costing the UK economy £14.7 billion' a year
Beware the 'Hi, how are you?' text. It's a scam - here's how it works | ZDNET
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Wanna bet? Scammers are playing the odds better than you are - Help Net Security
$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK
"Vibescamming" is the new online scam everyone’s falling for
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data
Google goes after massive phishing enterprise behind those spammy USPS messages - Neowin
Google Looks to Dim 'Lighthouse' Phishing Kit
New NCA Campaign Warns Men Off Crypto Investment Scams - Infosecurity Magazine
'Dodgy' Amazon Fire TV sticks are leaving users open to financial fraud | News Tech | Metro News
Improve Collaboration to Hit Back At Rising Fraud, Says techUK - Infosecurity Magazine
Lost iPhone? Don’t fall for phishing texts saying it was found
How Elder Fraud Reveals Gaps in Human-Centric Security
Artificial Intelligence
Survey Surfaces Sharp Rise in Cybersecurity Incidents Involving AI - Security Boulevard
"Vibescamming" is the new online scam everyone’s falling for
AI and phishing: a toxic pair | Professional Security Magazine
Cybercriminals Are Now Using AI to Create Shape-Shifting Malware, Google Warns
AI Agents Are Going Rogue: Here's How to Rein Them In
65% of Leading AI Companies Found With Verified Secrets Leaks - Infosecurity Magazine
Advocacy group calls on OpenAI to address Sora 2’s deepfake risks | CyberScoop
Los Alamos researchers warn AI may upend national security - Help Net Security
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
AI chat privacy at risk: Microsoft details Whisper Leak side-channel attack
Military experts warn security hole in most AI chatbots can sow chaos
Execs Say AI Use is Making Companies Vulnerable to Attacks: Survey | MSSP Alert
Many Forbes AI 50 Companies Leak Secrets on GitHub - SecurityWeek
Shadow AI risk: Navigating the growing threat of ungoverned AI adoption - Help Net Security
Legal Reputations at Risk: How AI is Reshaping Cyber Threats in Law – Artificial Lawyer
'Ransomvibing' Infests Visual Studio Extension Market
Autonomous AI could challenge how we define criminal behavior - Help Net Security
Oddest ChatGPT leaks yet: Cringey chat logs found in Google analytics tool - Ars Technica
Malware
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
Hackers Exploiting RMM Tools LogMeIn and PDQ Connect to Deploy Malware as a Normal Program
Cybercriminals Are Now Using AI to Create Shape-Shifting Malware, Google Warns
Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware
Infostealers are making this old security practice new again | PCWorld
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
Hackers Weaponizing Calendar Files as a New Attack Vector Bypassing Traditional Email Defenses
Threat Actors Attacking Outlook and Google Bypassing Traditional Email Defenses
DanaBot malware is back to infecting Windows after 6-month break
Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack
GootLoader Is Back, Using a New Font Trick to Hide Malware on WordPress Sites
Rhadamanthys infostealer disrupted as cybercriminals lose server access
Ferocious Kitten APT Deploying MarkiRAT to Capture Keystroke and Clipboard Logging
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium - SecurityWeek
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Hidden Logic Bombs in Malware-Laced NuGet Packages Set to Detonate Years After Installation
Hackers abuse Triofox antivirus feature to deploy remote access tools
Bots/Botnets
A new round of Europol’s Operation Endgame dismantled Rhadamanthys, Venom RAT, and Elysium botnet
Mobile
Beware the 'Hi, how are you?' text. It's a scam - here's how it works | ZDNET
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
Google Play Store hosted 239 malicious apps that were downloaded 40 million times - gHacks Tech News
Warning! Don't open these WhatsApp images, else you'll get hacked | PCWorld
New Android Malware ‘Fantasy Hub’ Intercepts SMS Messages, Contacts and Call Logs
Android malware steals your card details and PIN to make instant ATM withdrawals | Malwarebytes
Android Devices Targeted by KONNI APT in Find Hub Exploitation - Infosecurity Magazine
Popular Android-based photo frames download malware on boot
Lost iPhone? Don’t fall for phishing texts saying it was found
Denial of Service/DoS/DDoS
Cisco: Actively exploited firewall flaws now abused for DoS attacks
Multiple Django Vulnerabilities Enable SQL injection and DoS Attack
Cyberattack hits Danish government and defence companies | European Pravda
Internet of Things – IoT
UK.gov probes security risks of Chinese electric buses • The Register
Data Breaches/Leaks
Allianz UK confirms Oracle EBS compromise • The Register
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site - SecurityWeek
65% of Leading AI Companies Found With Verified Secrets Leaks - Infosecurity Magazine
Synnovis Finally Issues Breach Notification After 2024 Ransomware Atta - Infosecurity Magazine
Hackers claim to leak Collins Aerospace data | Cybernews
UK NHS Named in Clop Gang's Exploits of Oracle Zero-Days
AI chat privacy at risk: Microsoft details Whisper Leak side-channel attack
Military experts warn security hole in most AI chatbots can sow chaos
Execs Say AI Use is Making Companies Vulnerable to Attacks: Survey | MSSP Alert
Many Forbes AI 50 Companies Leak Secrets on GitHub - SecurityWeek
Legal Reputations at Risk: How AI is Reshaping Cyber Threats in Law – Artificial Lawyer
Washington Post data breach impacts nearly 10K employees, contractors
Website Security Breaches: 13 Lessons Learned from Small Businesses - DevX
Whisper Leak: A novel side-channel attack on remote language models | Microsoft Security Blog
GlobalLogic Becomes Latest Cl0p Victim After Oracle EBS Attack - Infosecurity Magazine
New IT woe at Legal Aid Agency | Law Gazette
Oddest ChatGPT leaks yet: Cringey chat logs found in Google analytics tool - Ars Technica
Organised Crime & Criminal Actors
The Professionalised World of Cybercrime and the New Arms Race - Security Boulevard
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Yanluowang initial access broker pleaded guilty to ransomware attacks
Autonomous AI could challenge how we define criminal behavior - Help Net Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK
New NCA Campaign Warns Men Off Crypto Investment Scams - Infosecurity Magazine
Insider Risk and Insider Threats
Cyberattack impact on employees may be as serious as technical fallout
Insurance
Ransomware fuels 230% increase in UK cyber insurance payouts • The Register
Cyber insurance pay-outs triple | Professional Security Magazine
Nearly £200 million paid in cyber claims to help UK businesses recover | ABI
Cyber Execs Get Insurance, Legal Counsel Perks Amid Higher Risks
Supply Chain and Third Parties
Allianz UK confirms Oracle EBS compromise • The Register
Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site - SecurityWeek
Synnovis notifies of data breach after 2024 ransomware attack
Synnovis Finally Issues Breach Notification After 2024 Ransomware Atta - Infosecurity Magazine
GlobalLogic Becomes Latest Cl0p Victim After Oracle EBS Attack - Infosecurity Magazine
Cloud/SaaS
Microsoft Teams’ New “Chat with Anyone” Feature Exposes Users to Phishing and Malware Attacks
Microsoft's data sovereignty: Now with extra sovereignty! • The Register
Identity and Access Management
Active Directory Under Siege: Why Critical Infrastructure Needs Stronger Security
Encryption
Are we ready for the post-quantum era? | TechRadar
Linux and Open Source
CISA warns of Akira ransomware Linux encryptor targeting Nutanix VMs
Passwords, Credential Stuffing & Brute Force Attacks
New Phishing Attack Leverages Popular Brands to Harvest Login Credentials - Cyber Security News
Enterprise Credentials at Risk – Same Old, Same Old?
Social Media
5 reasons why attackers are phishing over LinkedIn
Phishers target 5K Facebook advertisers with fake biz pages • The Register
The common social media security measure that creates a treasure trove for hackers | The Independent
Online age checking is creating a treasure trove of data for hackers
New Age Verification Bills Could Ban VPNs, Jeopardize the Privacy of Millions - CNET
Regulations, Fines and Legislation
ID verification laws are fueling the next wave of breaches
New Age Verification Bills Could Ban VPNs, Jeopardize the Privacy of Millions - CNET
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
Cyber bill offers 'no guarantee of security', tech lawyer says - UKTN
Exclusive: Ofcom is monitoring VPNs following Online Safety Act. Here's how | TechRadar
The Government Shutdown Is a Ticking Cybersecurity Time Bomb | WIRED
China amends its Cybersecurity Law
America’s cybersecurity defenses are cracking | The Verge
Cyber information sharing law would get extension under shutdown deal bill | CyberScoop
CISA, FCEA funding set to resume as shutdown nears its end • The Register
Age verification lands in Italy − here’s how it affects VPN users | TechRadar
Models, Frameworks and Standards
A guide to the UK Cyber Security and Resilience Bill (CSRB) | Professional Security Magazine
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
Broken access control still tops list of app sec top 10 • The Register
Data Protection
EU’s leaked GDPR, AI reforms slated by privacy activists • The Register
Careers, Working in Cyber and Information Security
CISOs are cracking under pressure - Help Net Security
CISO Pay Packages Grow as Overall Security Spending Slows: IANS | MSSP Alert
From Forensics to AI: New bulletin maps out Cyber Security careers | Department for the Economy
Why We Need More Veterans in Intelligence, Cybersecurity, and STEM - ClearanceJobs
Resilience for resilience: Managing burnout among cyber leaders | Computer Weekly
The New Battlefield: 3 Veterans Discuss Their Transition to Cybersecurity | Security Magazine
Cyber Execs Get Insurance, Legal Counsel Perks Amid Higher Risks
Law Enforcement Action and Take Downs
$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK
1,000+ Servers Hit in Law Enforcement Takedown of Rhadamanthys, VenomRAT, Elysium - SecurityWeek
New NCA Campaign Warns Men Off Crypto Investment Scams - Infosecurity Magazine
Yanluowang initial access broker pleaded guilty to ransomware attacks
Russian hacker admits helping Yanluowang ransomware infect companies
Russian pleads guilty, staring at 53 years and $9.2M penalty - Cryptopolitan
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Spy boss says authoritarian nations poised for sabotage • The Register
Los Alamos researchers warn AI may upend national security - Help Net Security
From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools
Data breach at Chinese infosec firm reveals weapons arsenal • The Register
Russia's suspected 'hybrid war' puts European air defences to the test | The Straits Times
War continues in cyberspace: Final cybersecurity education session concludes in Kyiv
TP-Link Routers Could Soon Be Banned. Here's What Cybersecurity Experts Say About the Risk - CNET
The threat of space terrorism is no longer science fiction, but we’re ill-prepared to combat it
Nation State Actors
China
Spy boss says authoritarian nations poised for sabotage • The Register
Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign - SecurityWeek
Chinese spies used Claude to break into critical orgs • The Register
From Log4j to IIS, China's Hackers Turn Legacy Bugs into Global Espionage Tools
Data breach at Chinese infosec firm reveals weapons arsenal • The Register
UK.gov probes security risks of Chinese electric buses • The Register
Denmark and Norway investigate Yutong bus security flaw amid rising tech fears
TP-Link Routers Could Soon Be Banned. Here's What Cybersecurity Experts Say About the Risk - CNET
China amends its Cybersecurity Law
This Is the Platform Google Claims Is Behind a 'Staggering’ Scam Text Operation | WIRED
Palantir CEO Says a Surveillance State Is Preferable to China Winning the AI Race
Russia
Russia's suspected 'hybrid war' puts European air defences to the test | The Straits Times
War continues in cyberspace: Final cybersecurity education session concludes in Kyiv
Russian Hacking Group Sandworm Deploys New Wiper Malware in Ukraine - Infosecurity Magazine
Russian pleads guilty, staring at 53 years and $9.2M penalty - Cryptopolitan
Russian Hackers Create 4,300 Fake Travel Sites to Steal Hotel Guests' Payment Data
Belgian military intelligence service websites attacked by Russian hackers | VRT NWS: news
Russian hacker admits helping Yanluowang ransomware infect companies
Iran
Ferocious Kitten APT Deploying MarkiRAT to Capture Keystroke and Clipboard Logging
North Korea
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
Android Devices Targeted by KONNI APT in Find Hub Exploitation - Infosecurity Magazine
[Editorial] The silent war - The Korea Herald
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Emulating the Espionage-Oriented Group SideWinder - Security Boulevard
Tools and Controls
Hackers Exploiting RMM Tools LogMeIn and PDQ Connect to Deploy Malware as a Normal Program
Threat Actors Leverage RMM Tools to Deploy Medusa & DragonForce Ransomware
Why Cybersecurity Must Shift To Continuous Incident Response
Online age checking is creating a treasure trove of data for hackers
New Age Verification Bills Could Ban VPNs, Jeopardize the Privacy of Millions - CNET
Ransomware fuels 230% increase in UK cyber insurance payouts • The Register
Cisco: Actively exploited firewall flaws now abused for DoS attacks
AI is forcing boards to rethink how they govern security - Help Net Security
ISO - Threat intelligence and why it matters for cybersecurity
Controversy Brews: US Government Targets Banning Top Wi-Fi Router - CNET
Broken access control still tops list of app sec top 10 • The Register
Exclusive: Ofcom is monitoring VPNs following Online Safety Act. Here's how | TechRadar
Resilience and AI risk | Professional Security Magazine
Automation can't fix broken security basics - Help Net Security
The browser is eating your security stack - Help Net Security
CISA warns of Akira ransomware Linux encryptor targeting Nutanix VMs
Active Directory Under Siege: Why Critical Infrastructure Needs Stronger Security
Age verification lands in Italy − here’s how it affects VPN users | TechRadar
To get funding, CISOs are mastering the language of money - Help Net Security
Reducing the risk of major cyber incidents in the UK through digital resilience | UKAuthority
NCSC Set to Retire Web Check and Mail Check Tools - Infosecurity Magazine
Other News
Who Owns the Cybersecurity of Space? - DataBreachToday
Europe Must Close the Space Gap by Anders Fogh Rasmussen - Project Syndicate
Logistics companies are increasingly targeted by cybercriminals | CargoForwarder Global
Telecoms Cyber Chiefs Adopt Financial Sector’s Model of Collective Defense - WSJ
Vulnerability Management
When Attacks Come Faster Than Patches: Why 2026 Will be the Year of Machine-Speed Security
Microsoft: Windows 11 23H2 Home and Pro reach end of support
Vulnerabilities
Cisco: Actively exploited firewall flaws now abused for DoS attacks
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
Cisco fixes critical UCCX flaw allowing Root command execution
SAP fixed a maximum severity flaw in SQL Anywhere Monitor
Zoom Workplace for Windows Vulnerability Allow Users to Escalate Privilege
Chipmaker Patch Tuesday: Over 60 Vulnerabilities Patched by Intel - SecurityWeek
High-Severity Vulnerabilities Patched by Ivanti and Zoom - SecurityWeek
Firefox 145 and Chrome 142 Patch High-Severity Flaws in Latest Releases - SecurityWeek
CitrixBleed 2, Cisco Flaw Wreak Havoc as Zero-Day Bugs
CISA Flags Critical WatchGuard Fireware Flaw Exposing 54,000 Fireboxes to No-Login Attacks
Microsoft Exchange 'Under Imminent Threat', Act Now
Fortinet FortiWeb flaw with public PoC exploited to create admin users
Palo Alto PAN-OS Firewall Vulnerability Let Attackers Reboot Firewall by Sending Malicious Packet
Android Devices Targeted by KONNI APT in Find Hub Exploitation - Infosecurity Magazine
Multiple Django Vulnerabilities Enable SQL injection and DoS Attack
Dangerous runC flaws could allow hackers to escape Docker containers
Adobe Patches 29 Vulnerabilities - SecurityWeek
Hackers abuse Triofox antivirus feature to deploy remote access tools
QNAP fixes seven NAS zero-day flaws exploited at Pwn2Own
Critical Triofox Vulnerability Exploited in the Wild - SecurityWeek
RCE flaw in ImunifyAV puts millions of Linux-hosted sites at risk
ChatGPT Vulnerability Exposed Underlying Cloud Infrastructure - SecurityWeek
Synology fixes BeeStation zero-days demoed at Pwn2Own Ireland
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Advisory - 12 November 2025 - Security Updates from Microsoft, Adobe and SAP
Black Arrow Cyber Advisory - 12 November 2025 - Security Updates from Microsoft, Adobe and SAP
Executive Summary
This month’s Patch Tuesday features updates from Microsoft, Adobe and SAP. Microsoft’s release spans Windows, Microsoft 365/Office components and server/identity platforms. Adobe has posted product-specific advisories across its portfolio. SAP published its November Patch Day with a notable volume of new Security Notes. Prioritise internet-facing systems, identity infrastructure and widely deployed desktop applications, with emphasis on critical remote code execution and privilege escalation fixes.
Vulnerabilities by Vendor
Microsoft addressed 63 vulnerabilities impacting Windows, Windows Components, Office, Office Components, Edge, Azure Monitor Agent, Dynamics 365, Hyper-V, SQL Server, and WSL (Windows Subsystem for Linux) GUI. Four of these vulnerabilities are rated as Critical and 59 are rated Important. No vulnerabilities addressed this month were publicly known at the time of release and none are known to be under active exploitation.
Adobe updated addresses 29 vulnerabilities across InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins products. Critical arbitrary code execution vulnerabilities were addressed in InDesign, InCopy, Photoshop, Illustrator, Substance 3D Stager, and Format Plugins. Adobe says there is no evidence that any of these vulnerabilities are known to have been exploited in the wild.
SAP addressed 19 security vulnerabilities this month, including a critical flaw in SQL Anywhere Monitor and other vulnerabilties relating to Solution Manager, CommonCryptoLib, NetWeaver AS ABAP/Java, S/4HANA components, Business Connector, SAP GUI.
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
For more information:
Microsoft — https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov
Adobe — https://helpx.adobe.com/security/security-bulletin.html
SAP — https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2025.html
Black Arrow Cyber Threat Intelligence Briefing 07 November 2025
Black Arrow Cyber Threat Intelligence Briefing 07 November 2025:
-Enterprises are Not Prepared for a World of Malicious AI Agents
-The Phishing Renaissance, How AI Brought Back the Classics
-‘Data Sprawl’ Is Now Your Security Team’s Biggest Headache – And It’s Only Going to Get Worse
-Old Threats, New Consequences: 90% of Cyber Claims Stem from Email and Remote Access
-Survey: Organisations are Too Confident in Their Cyber Resiliency
-Thousands Fall Victim to Ransomware as European Attacks Reach Record Highs - Here’s Why They’re So at Risk
-How Ransomware Attacks Leverage Cyber Insurance Policies
-Violent Cybercrime Surges in Europe Amid Big Payouts
-Three of the Biggest Cybercrime Gangs Around Appear to Be Teaming Up - Which Could Be Bad News for All of Us
-Google Says 2026 Will Be the Year AI Supercharges Cybercrime
-Enterprises are Losing Track of the Devices Inside Their Networks
-Britain ‘Highly Vulnerable’ to Russian Cyber Attacks, Warns Former Army Chief
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week’s stories highlight how AI is reshaping cyber threats, with malicious agents, deepfakes and automated phishing increasing both scale and sophistication. In particular, when AI agents are given their own credentials or identities, this increases the risks that are exploited by attackers. Business leaders must now consider AI-driven risks as part of their core governance responsibilities. Risks are further increased because of the growth of data held by businesses, including redundant or abandoned data.
We also report on the resurgence of classic attack methods like phishing and email compromise, now supercharged by generative AI. Ransomware remains a dominant threat, with attackers exploiting cyber insurance policies and even resorting to physical intimidation. European organisations are particularly exposed, and many still pay ransoms, which encourages repeat targeting. Research shows that business leaders have an inaccurate perception of their organisation’s readiness to recover from an incident.
The key theme here is the need for business leaders to be informed of the current and emerging threats to their business, and to know how to mitigate these risks through a strategy that they govern alongside their other risks. Contact us to discuss how to make this work proportionately in your organisation.
Top Cyber Stories of the Last Week
Enterprises are Not Prepared for a World of Malicious AI Agents
Palo Alto Networks CEO Nikesh Arora warns that most organisations are ill equipped to manage the growing number of AI agents accessing corporate systems. These non-human identities can act like employees, holding credentials and privileges that expand the attack surface. Existing identity and privileged access tools track only a fraction of users, leaving many AI agents unmonitored. This gap will worsen as both legitimate and malicious agents proliferate. A centralised management of user access and permissions is needed to prevent uncontrolled access and misuse.
Source: https://www.zdnet.com/article/enterprises-are-not-prepared-for-a-world-of-malicious-ai-agents/
The Phishing Renaissance, How AI Brought Back the Classics
Classic phishing methods such as credential theft and vendor impersonation are resurging because AI makes personalisation easy. Generative tools remove the grammatical errors that once revealed scams, allowing criminals to adapt tone and context for each target. Deepfakes and voice cloning add realism to social engineering, while business email compromise continues to succeed without malware. Human awareness and layered verification are essential as AI amplifies the effectiveness of old techniques.
Source: https://securityboulevard.com/2025/10/the-phishing-renaissance-how-ai-brought-back-the-classics/
‘Data Sprawl’ Is Now Your Security Team’s Biggest Headache – And It’s Only Going to Get Worse
Growth of data across cloud, hybrid and SaaS environments is overwhelming security teams. One-third of UK organisations saw data volumes surge by 30% or more in the past year and 41% of large enterprises now manage over a petabyte. Around 38% flag redundant or abandoned data as a security risk, while 85% of organisations globally report data loss incidents. The rise of generative AI and weak visibility are exacerbating the issue, and firms should embed privacy-by-design and governance before attackers exploit the chaos.
Old Threats, New Consequences: 90% of Cyber Claims Stem from Email and Remote Access
Insurance data shows that most cyber claims originate from email and remote access breaches. Email accounted for 43% of incidents in 2024, with claim frequency rising 30% year on year. Fraud often begins with inbox compromise or near lookalike domains, and average illicit transfers reached $286,000. Generative AI is accelerating attacker success, highlighting that familiar entry points remain the most costly for organisations.
Survey: Organisations are Too Confident in Their Cyber Resiliency
A global study of 1,773 leaders finds widespread overconfidence in cyber resilience. While 95% believe they can recover from ransomware, 40% were attacked in the past year and only 15% fully restored their data. 45% paid ransoms, with 30% paying over $250,000. 44% report deepfake enabled attacks and many lack clear policies on generative AI. The findings reveal a gap between perceived and actual preparedness.
Thousands Fall Victim to Ransomware as European Attacks Reach Record Highs - Here’s Why They’re So at Risk
Europe now accounts for almost 22% of global victims posted on leak sites since 2024, with more than 2,100 European organisations listed. Exposure is driven by lucrative sectors, GDPR penalties that can encourage payment and geopolitical spillover from the war in Ukraine. Average time from initial access to deployment is 35.5 hours, compressing response windows and increasing operational impact. Intelligence led defence and faster containment are essential.
How Ransomware Attacks Leverage Cyber Insurance Policies
Attackers increasingly search for cyber insurance documents to shape negotiations. Knowledge of limits, coverage and approved vendors allows demands that appear reasonable relative to downtime and costs. Policies should be protected like confidential financial records, with strict access, secure storage, offline copies and staff awareness to prevent leverage during extortion.
Source: https://securityboulevard.com/2025/11/how-ransomware-attacks-leverage-cyber-insurance-policies/
Violent Cybercrime Surges in Europe Amid Big Payouts
Some cyber attackers are pairing online extortion with real world intimidation to force payment. Rising revenues and professionalisation are driving aggression, with threats extending beyond data leaks. Response plans should include physical safety considerations and coordination with law enforcement as pressure tactics escalate.
Source: https://www.theregister.com/2025/11/04/cybercriminals_increasingly_rely_on_violence/
Three of the Biggest Cybercrime Gangs Around Appear to Be Teaming Up - Which Could Be Bad News for All of Us
Scattered Spider, Lapsus$ and ShinyHunters have reportedly united under the new banner “Scattered Lapsus$ Hunters” (SLH). Operating via Telegram, the alliance combines social engineering, credential theft and data-leak extortion into a professionalised “Extortion-as-a-Service” model. The groups seek both profit and notoriety, marking a shift toward cybercrime branding that increases visibility and risk for global enterprises.
Google Says 2026 Will Be the Year AI Supercharges Cybercrime
Google forecasts that by 2026, AI will drive both attacks and defences. Adversaries will automate phishing, deepfakes and prompt injection exploits against large language models. A growing concern is unmonitored bots or scripts with system access that act without oversight; these hidden identities could move data or perform actions unseen by security teams. The report urges strict control, identity tracking and AI-led containment to counter this evolving threat.
Source: https://www.helpnetsecurity.com/2025/11/05/google-cybersecurity-forecast-2026/
Enterprises are Losing Track of the Devices Inside Their Networks
A study of 10 million devices across more than 700 organisations shows that two-thirds are not traditional IT assets such as servers or laptops. Instead, they include extended IoT devices like VoIP phones, cameras, point-of-sale systems and power supplies. On average, firms manage 164 device types, 1,629 vendors and 876 OS versions. With 40% of cameras containing known flaws and 3% exposed online, organisations must urgently regain visibility and control over every connected device.
Source: https://www.helpnetsecurity.com/2025/11/06/enterprise-xiot-devices-risk/
Britain ‘Highly Vulnerable’ to Russian Cyber Attacks, Warns Former Army Chief
Field Marshal Lord Houghton warns that Britain’s cyber defences are not yet fit for purpose and that the nation remains highly vulnerable to hostile cyber activity. Recent breaches affecting the Ministry of Defence and major contractors highlight deep weaknesses. He urges greater investment in AI and autonomous systems to boost military capability and calls for closer coordination between government, industry and the Armed Forces to strengthen resilience.
Source: https://www.telegraph.co.uk/news/2025/11/06/british-army-russian-attack-field-marshal-lord-houghton/
Governance, Risk and Compliance
82 percent of finserv organizations suffered a data breach in the last year - BetaNews
CISO Burnout – Epidemic, Endemic, or Simply Inevitable? - SecurityWeek
Survey: Organizations Are Too Confident in Their Cyber Resiliency - Security Boulevard
Financial services can't shake security debt - Help Net Security
UK’s National Cyber Security Centre Releases 2025 Annual Review | Alston & Bird - JDSupra
Google Forecasts Rise of Cyber-Physical Attacks Targeting Europe - Infosecurity Magazine
Nation-State, Cyber and Hacktivist Threats Pummel Europe
Violent cybercrime surges in Europe amid big payouts • The Register
Firms prioritise AI and cyber security in tackling digital threats - CIR Magazine
The Next Evolution Of Cybersecurity Is Preemptive
Gartner just dropped its 2026 tech trends - and it's not all AI: Here's the list | ZDNET
To maximize their influence, CISOs need diverse skills | TechTarget
CISOs in court: Balancing cyber resilience and legal accountability | Computer Weekly
Threats
Ransomware, Extortion and Destructive Attacks
Cyber loot flows to Russia and its friends | Cybernews
What Makes Ransomware Groups Successful?
Rhysida ransomware exploits Microsoft certificate to slip malware past defenses | CSO Online
Cybersecurity experts charged with running BlackCat ransomware operation | CSO Online
Ransomware attacks are hitting European enterprises at record pace | IT Pro
Leak Site Ransomware Victims Spike 13% in a Year - Infosecurity Magazine
Beware - ransomware gang is tricking victims with fake Microsoft Teams ads | TechRadar
How Ransomware Attacks Leverage Cyber Insurance Policies - Security Boulevard
DragonForce Cartel Emerges as Conti-Derived Ransomware Threat - Infosecurity Magazine
U.S. Sanctions 10 North Korean Entities for Laundering $12.7M in Crypto and IT Fraud
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
Ongoing Ransomware Attacks Exploit Linux Vulnerability, CISA Warns
Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine - Ars Technica
Ukrainian allegedly involved in Conti ransomware attacks faces up to 25 years in jail | CyberScoop
Ransomware Victims
Conduent January 2025 breach impacts 10M+ people
M&S cyberattack cost £136m but retailer ‘regaining momentum’ | News | The Grocer
Results: Cyber attack more than halved M&S first half profits - Retail Gazette
Hackers hit a Swiss bank, claiming 2.5TB of data | Cybernews
How a ransomware gang encrypted Nevada government's systems
Nevada Refused to Pay Cyberattack Ransom as Systems Sat Compromised for Months – DataBreaches.Net
Apache OpenOffice disputes data breach claims by ransomware gang
"Pay up or we share the tapes": Hackers target massage parlour clients in blackmail scheme
Oncology Institute Reports Cybersecurity Incident Impact - TipRanks.com
Phishing & Email Based Attacks
The Phishing Renaissance, How AI Brought Back the Classics - Security Boulevard
Old threats, new consequences: 90% of cyber claims stem from email and remote access | CSO Online
ClickFix malware attacks evolve with multi-OS support, video tutorials
How Phishing Kits Are Evading Detection & Ways to Beat Them | MSSP Alert
Is your business prepared for these growing phishing scams? | TechRadar
“I Paid Twice” Phishing Campaign Targets Booking.com - Infosecurity Magazine
Other Social Engineering
ClickFix malware attacks evolve with multi-OS support, video tutorials
In an AI World, Every Attack is a Social Engineering Attack - Security Boulevard
Is your business ready for a deepfake attack? 4 steps to take before it's too late | ZDNET
Cybercriminals have built a business on YouTube’s blind spots - Help Net Security
UK carriers to block spoofed phone numbers in fraud crackdown
SMS Fraud Losses Set to Decline 11% in 2026 - Infosecurity Magazine
Sora 2 Creates Believable Videos,Reality Checks Needed
AI makes holiday shopping scams harder to spot - BetaNews
Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries
Fraud, Scams and Financial Crime
Europe's phone networks are drowning in fake calls - Help Net Security
Google Report Reveals How Text Scams Steal Your Data And Money
Cybercriminals have built a business on YouTube’s blind spots - Help Net Security
UK carriers to block spoofed phone numbers in fraud crackdown
SMS Fraud Losses Set to Decline 11% in 2026 - Infosecurity Magazine
AI makes holiday shopping scams harder to spot - BetaNews
Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries
Experts warn AI tools are fueling a rise in scams targeting older adults - BetaNews
Artificial Intelligence
The Phishing Renaissance, How AI Brought Back the Classics - Security Boulevard
Ransomware Attack on European Organizations Surge as Hackers Leveraging AI-Tools for Attacks
Google says 2026 will be the year AI supercharges cybercrime - Help Net Security
Cybercrime To Hit Critical Supply Chains As AI Amplifies Global Risk, Google Warns | Scoop News
Cybercriminals Armed With AI Often Find Mid-Sized Businesses Are Sitting Ducks | Law.com
Enterprises are not prepared for a world of malicious AI agents | ZDNET
List of AI Tools Promoted by Threat Actors in Underground Forums and Their Capabilities
In an AI World, Every Attack is a Social Engineering Attack - Security Boulevard
Is your business ready for a deepfake attack? 4 steps to take before it's too late | ZDNET
Google uncovers malware using LLMs to operate and evade detection - Help Net Security
Malware Now Uses AI During Execution to Mutate and Collect Data, Google Warns - SecurityWeek
Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data
The cottage industry quietly manipulating chatbots’ replies
Sora 2 Creates Believable Videos,Reality Checks Needed
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities
Tech groups step up efforts to solve AI’s big security flaw
Microsoft Detects "SesameOp" Backdoor Using OpenAI's API as a Stealth Command Channel
Claude Desktop Extensions Vulnerable to Web-Based Prompt Injection - Infosecurity Magazine
Microsoft: A key OpenAI API is being used for 'espionage' by bad actors | Mashable
AI makes holiday shopping scams harder to spot - BetaNews
Google Threat Report Links AI-powered Malware to DPRK Crypto Theft - Decrypt
Malware
Google uncovers malware using LLMs to operate and evade detection - Help Net Security
New malware uses AI to adapt during attacks, report finds | The Record from Recorded Future News
ClickFix malware attacks evolve with multi-OS support, video tutorials
Weaponized Putty and Teams Ads Deliver Malware Allowing Hackers to Access Network
Chinese APT Uses 'Airstalk' Malware in Supply Chain Attacks - SecurityWeek
Russian hackers abuse Hyper-V to hide malware in Linux VMs
Rhysida ransomware exploits Microsoft certificate to slip malware past defenses | CSO Online
Australia warns of BadCandy infections on unpatched Cisco devices
Fake Solidity VSCode extension on Open VSX backdoors developers
Gootloader malware is back with new tricks after 7-month break
Operation SkyCloak Deploys Tor-Enabled OpenSSH Backdoor Targeting Defense Sectors
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
New HttpTroy Backdoor Poses as VPN Invoice in Targeted Cyberattack on South Korea
Russian hackers hit Windows machines via Linux VMs with new custom malware | TechRadar
Mobile
Europe's phone networks are drowning in fake calls - Help Net Security
Google Report Reveals How Text Scams Steal Your Data And Money
Android Malware Mutes Alerts, Drains Crypto Wallets
Backdoored ‘secure’ messaging app leads to more arrests • The Register
Report finds 67% surge in Android mal... - Mobile World Live
Malicious Android apps on Google Play downloaded 42 million times
Xi Jinping jokes about backdoors in Xiaomi smartphones • The Register
Denial of Service/DoS/DDoS
Hacktivist-Driven DDoS Dominates Attacks on Public Sector - Infosecurity Magazine
Internet of Things – IoT
The Hidden Risks of Third-Party IoT Devices: What Organizations Need t - Infosecurity Magazine
Why millions of connected vehicles need automated cyber security | TechRadar
Enterprises are losing track of the devices inside their networks - Help Net Security
An 18-Year-Old Codebase Left Smart Buildings Wide Open
Connected devices may face mandatory security checks before you can use them
Data Breaches/Leaks
82 percent of finserv organizations suffered a data breach in the last year - BetaNews
Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data
Conduent January 2025 breach impacts 10M+ people
Hackers hit a Swiss bank, claiming 2.5TB of data | Cybernews
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
Court reimposes original sentence for Capital One hacker | CyberScoop
Lawmakers say stolen police logins are exposing Flock surveillance cameras to hackers | TechCrunch
Washington Post says it is among victims of cyber breach tied to Oracle software | Reuters
Software dev accidentally leaks Australian govt documents | Information Age | ACS
Data breach at major Swedish software supplier impacts 1.5 million
US Congressional Budget Office hit by cybersecurity incident | Reuters
Apache OpenOffice disputes data breach claims by ransomware gang
Media giant Nikkei reports data breach impacting 17,000 people
Hyundai AutoEver America data breach exposes SSNs, drivers licenses
Organised Crime & Criminal Actors
Scattered Spider, ShinyHunters and LAPSUS$ Form Unified Collective - Infosecurity Magazine
DragonForce Cartel Emerges as Conti-Derived Ransomware Threat - Infosecurity Magazine
‘Scamming became the new farming’: inside India’s cybercrime villages | Cybercrime | The Guardian
Cyber surveillance of British businesses | Professional Security Magazine
Operation Chargeback Uncovers €300m Fraud Scheme in 193 Countries - Infosecurity Magazine
Court reimposes original sentence for Capital One hacker | CyberScoop
Nine Arrested in €600M crypto laundering bust across Europe
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
Firms at risk as Japan struggles to keep up with cybercrime amid rise of ransomware - The Mainichi
US Refuses to Sign UN Cybercrime Treaty
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Operation Chargeback Uncovers €300m Fraud Scheme in 193 Countries - Infosecurity Magazine
18 arrested in €300 million global credit card fraud scheme - Help Net Security
Android Malware Mutes Alerts, Drains Crypto Wallets
Hacker steals over $120 million from Balancer DeFi crypto protocol
Nine Arrested in €600M crypto laundering bust across Europe
Google Threat Report Links AI-powered Malware to DPRK Crypto Theft - Decrypt
Insider Risk and Insider Threats
Employees keep finding new ways around company access controls - Help Net Security
Insurance
How Ransomware Attacks Leverage Cyber Insurance Policies - Security Boulevard
Is cyber on the verge of becoming uninsurable? | Insurance Business America
Supply Chain and Third Parties
Cybercrime To Hit Critical Supply Chains As AI Amplifies Global Risk, Google Warns | Scoop News
Chinese APT Uses 'Airstalk' Malware in Supply Chain Attacks - SecurityWeek
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
Washington Post says it is among victims of cyber breach tied to Oracle software | Reuters
Software dev accidentally leaks Australian govt documents | Information Age | ACS
Data breach at major Swedish software supplier impacts 1.5 million
Open VSX rotates access tokens used in supply-chain malware attack
Software Supply Chain
Cloud/SaaS
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
Microsoft Warns of 'Payroll Pirates' Hijacking HR SaaS Accounts to Steal Employee Salaries
Researchers Just Revealed 4 Big Microsoft Teams Vulnerabilities
With each cloud outage, calls for government action grow louder | CyberScoop
EU and UK organizations ponder resilience after Azure outage • The Register
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
UK accused of being too slow to regulate cloud services providers
Oracle’s cloud strategy an increasingly risky bet | CIO
Outages
EU and UK organizations ponder resilience after Azure outage • The Register
With each cloud outage, calls for government action grow louder | CyberScoop
Identity and Access Management
Employees keep finding new ways around company access controls - Help Net Security
Linux and Open Source
Russian hackers abuse Hyper-V to hide malware in Linux VMs
Ongoing Ransomware Attacks Exploit Linux Vulnerability, CISA Warns
International Criminal Court dumps Microsoft Office • The Register
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
Logging in as root on Linux? Here's why that disaster waiting to happen | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
The Louvre’s video surveillance had a shockingly weak password | Cybernews
Have I Been Pwned adds a billion new passwords to its database - gHacks Tech News
The Worst Password Of 2025 Is '123456' - Make Sure You Don't Use These
What are the most common passwords? No surprises here • The Register
Social Media
Cybercriminals have built a business on YouTube’s blind spots - Help Net Security
Malvertising
Beware - ransomware gang is tricking victims with fake Microsoft Teams ads | TechRadar
Weaponized Putty and Teams Ads Deliver Malware Allowing Hackers to Access Network
Training, Education and Awareness
What keeps phishing training from fading over time - Help Net Security
Study concludes cybersecurity training doesn’t work | KPBS Public Media
Regulations, Fines and Legislation
U.S. Sanctions 10 North Korean Entities for Laundering $12.7M in Crypto and IT Fraud
Report: 36% of companies do not know whether they are covered by NIS2 directive
Cyber Resilience Act: Overview for affected companies
With each cloud outage, calls for government action grow louder | CyberScoop
Connected devices may face mandatory security checks before you can use them
The US must not endorse Russia and China’s vision for cybersecurity
UK accused of being too slow to regulate cloud services providers
US Refuses to Sign UN Cybercrime Treaty
Trump admin begins developing new cybersecurity strategy
Senate approves new leader for Army Cyber Command - Breaking Defense
Old privacy laws create new risks for businesses - Help Net Security
Models, Frameworks and Standards
Report: 36% of companies do not know whether they are covered by NIS2 directive
Cyber Resilience Act: Overview for affected companies
Old privacy laws create new risks for businesses - Help Net Security
Data Protection
Old privacy laws create new risks for businesses - Help Net Security
Careers, Working in Cyber and Information Security
To maximize their influence, CISOs need diverse skills | TechTarget
Starting Over in Cybersecurity: Advice I Wish I'd Had
Law Enforcement Action and Take Downs
Operation Chargeback Uncovers €300m Fraud Scheme in 193 Countries - Infosecurity Magazine
Europe's phone networks are drowning in fake calls - Help Net Security
Backdoored ‘secure’ messaging app leads to more arrests • The Register
US cybersecurity experts indicted for BlackCat ransomware attacks
Nine Arrested in €600M crypto laundering bust across Europe
Court reimposes original sentence for Capital One hacker | CyberScoop
Ukrainian allegedly involved in Conti ransomware attacks faces up to 25 years in jail | CyberScoop
US Refuses to Sign UN Cybercrime Treaty
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Electronic Weapons: Russian Cyber War Against Germany
How nations build and defend their cyberspace capabilities - Help Net Security
Beyond Denial: Toward a Credible Cyber Deterrence Strategy • Stimson Center
Nation State Actors
SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach
Cyber Physical Systems Face Rising Geopolitical Risks
China
Cyber loot flows to Russia and its friends | Cybernews
The US must not endorse Russia and China’s vision for cybersecurity
Chinese APT Uses 'Airstalk' Malware in Supply Chain Attacks - SecurityWeek
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
Xi Jinping jokes about backdoors in Xiaomi smartphones • The Register
US Space Force to Use Three Weapons To Jam Chinese Satellites Via Remote Control - Bloomberg
Germany Weighs Paying Deutsche Telekom to Replace Huawei Gear - Bloomberg
Finland to Tighten Huawei Ban in 5G Network on Security Grounds - Bloomberg
China-linked hackers exploited Lanscope flaw as a zero-day in attacks
Russia
Britain ‘highly vulnerable’ to Russian cyber attacks, warns former Army chief
Cyber loot flows to Russia and its friends | Cybernews
Russian hackers hit Windows machines via Linux VMs with new custom malware | TechRadar
The US must not endorse Russia and China’s vision for cybersecurity
Electronic Weapons: Russian Cyber War Against Germany
The cottage industry quietly manipulating chatbots’ replies
Wipers from Russia’s most cut-throat hackers rain destruction on Ukraine - Ars Technica
Russia Wages War On The Internet In Ukraine, But Resistance Is Winning
Ukraine’s Security Service repels over 2,300 enemy cyberattacks in 2025 - Freedom
Offensive Cyber Operations and Combat Effectiveness After Ukraine | Lawfare
NATO's Crossed Swords cyber exercise gets underway in Tallinn | News | ERR
Russia arrests three suspected Meduza infostealer devs • The Register
Alleged Meduza Stealer malware admins arrested after hacking Russian org
Iran
UNK_SmudgedSerpent Targets Academics With Political Lures - Infosecurity Magazine
Iran's 'SmudgedSerpent APT Phishes US Policy Wonks
North Korea
Cyber loot flows to Russia and its friends | Cybernews
U.S. sanctioned North Korea bankers for laundering funds linked to cyberattacks and peapons program
Google Threat Report Links AI-powered Malware to DPRK Crypto Theft - Decrypt
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Nation-State, Cyber and Hacktivist Threats Pummel Europe
Hacktivist-Driven DDoS Dominates Attacks on Public Sector - Infosecurity Magazine
Tools and Controls
Old threats, new consequences: 90% of cyber claims stem from email and remote access | CSO Online
Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection
Russian hackers abuse Hyper-V to hide malware in Linux VMs
NATO's Crossed Swords cyber exercise gets underway in Tallinn | News | ERR
AI Becomes Both Tool and Target in Cybersecurity
Survey: Organizations Are Too Confident in Their Cyber Resiliency - Security Boulevard
Financial services can't shake security debt - Help Net Security
Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks
Russian hackers host secret VMs on Windows | Cybernews
EU and UK organizations ponder resilience after Azure outage • The Register
Enterprises are losing track of the devices inside their networks - Help Net Security
Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities
Vibe coding security risks and how to mitigate them | IT Pro
The Next Evolution Of Cybersecurity Is Preemptive
Browser detection and response fills gaps in security programs | TechTarget
AI can flag the risk, but only humans can close the loop - Help Net Security
Reports Published in the Last Week
UK’s National Cyber Security Centre Releases 2025 Annual Review | Alston & Bird - JDSupra
Other News
Zombie Projects Rise Again to Undermine Security
Louvre delayed Windows security updates ahead of burglary – Computerworld
Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks
International Criminal Court dumps Microsoft Office • The Register
Europe's energy grid faces growing cyber threat • The Register
Europe eyes digital sovereignty sans big tech | TelecomTV
Shipping’s cyber reckoning - Splash247
Ofcom to Boost UK Telecoms Security by Working with Key Countries - ISPreview UK
How can we keep our society and economy cyber secure? - New Statesman
How nations build and defend their cyberspace capabilities - Help Net Security
Totally Exposed at 30,000 Feet - Center for Democracy and Technology
Scottish Government launches refreshed cyber strategy
Cyber Physical Systems Face Rising Geopolitical Risks
Hospitals are running out of excuses for weak cyber hygiene - Help Net Security
The race to defend satellites from cyberattacks - SpaceNews
The Rising Tide of Cyber-Attacks Against the UK Water Sector | Fortra
Vulnerability Management
Zombie Projects Rise Again to Undermine Security
Louvre delayed Windows security updates ahead of burglary | CSO Online
UK dept spent £312M moving to Win 10 as support D-day hits • The Register
SolarWinds-Like Risk Lurks in Popular Installer Tool
Vulnerabilities
Researchers Just Revealed 4 Big Microsoft Teams Vulnerabilities
Update Chrome now: 20 security fixes just landed | Malwarebytes
Two Windows vulnerabilities, one a 0-day, are under active exploitation - Ars Technica
New Attack Combines Ghost SPNs and Kerberos Reflection to Elevate Privileges on SMB Servers
Cisco Warns of Hackers Actively Exploiting ASA and FTD 0-day RCE Vulnerability in the Wild
Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks
Australia warns of BadCandy infections on unpatched Cisco devices
Windows Graphics Vulnerabilities Allow Remote Attackers to Execute Arbitrary Code
New GDI Flaws Could Enable Remote Code Execution in Windows - Infosecurity Magazine
Android Update Patches Critical Remote Code Execution Flaw - SecurityWeek
Apple Patches Multiple Critical Vulnerabilities in iOS 26.1 and iPadOS 26.1
Cisco Warns of New Firewall Attack Exploiting CVE-2025-20333 and CVE-2025-20362
SolarWinds-Like Risk Lurks in Popular Installer Tool
Ongoing Ransomware Attacks Exploit Linux Vulnerability, CISA Warns
Hackers Exploit OneDrive.exe Through DLL Sideloading to Execute Arbitrary Code
Researchers Find ChatGPT Vulnerabilities That Let Attackers Trick AI Into Leaking Data
Claude Desktop Extensions Vulnerable to Web-Based Prompt Injection - Infosecurity Magazine
Hackers exploit critical auth bypass flaw in JobMonster WordPress theme
Microsoft: Patch for WSUS flaw disabled Windows Server hotpatching
Critical UniFi OS Vulnerability Enables Remote Code Execution Attacks
Microsoft: October Windows updates trigger BitLocker recovery
AMD confirms some Zen 5 CPUs have a worrying security flaw that could put users at risk | TechRadar
Exploited 'Post SMTP' Plugin Flaw Exposes WordPress Sites to Takeover - SecurityWeek
China-linked hackers exploited Lanscope flaw as a zero-day in attacks
Hackers exploit WordPress plugin Post SMTP to hijack admin accounts
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 31 October 2025
Black Arrow Cyber Threat Intelligence Briefing 31 October 2025:
-Ransomware Recovery Perils: 40% of Paying Victims Still Lose Their Data
-Reacting Slowly to a Security Breach Opens up Your Business to More Threats, Report Warns
-SMEs Unprepared to Defend Against Advanced Cyber Threats
-UK Financial Regulator to Focus on Cyber Defence
-The 10 Biggest Issues CISOs and Cyber Teams Face Today
-The Cyber Security Perception Gap: Why Executives and Practitioners See Security Differently
-Shadow AI: One In Four Employees Use Unapproved AI Tools, Research Finds
-LinkedIn Phishing Targets Finance Execs With Fake Board Invites
-Social Engineering: Why the ClickFix Malware Attack Just Won’t Go Away
-New Phishing Attack Using Invisible Characters Hidden in Subject Line
-BT Warns of Soaring Cyber Threats Targeting UK Firms
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week, ransomware continues to underline the need for leaders to plan to prevent attacks and manage them effectively if the worst happens, with 40% of paying victims still unable to recover their data. SMEs face rising exposure as cyber criminals exploit weaker controls and limited recovery planning, showing that every organisation must understand its risk profile and response capability.
We see the UK financial regulator strengthening its stance on operational resilience, signalling growing expectations for leadership accountability. Business leaders are reassessing their exposure and security, but with a clear need to ensure perceptions of security reflect reality. Current threats include shadow AI, LinkedIn campaigns targeting executives, persistent malware, advanced phishing, and attackers constantly scanning potential victims for exploitable weaknesses.
These developments reinforce that resilience includes building security and preparing to manage an incident. Contact us to discuss how we help achieve this, including through impartial incident-response simulations that help leaders rehearse and objectively challenge their preparedness.
Top Cyber Stories of the Last Week
Ransomware Recovery Perils: 40% of Paying Victims Still Lose Their Data
A Hiscox survey of SMEs found that two in five organisations that pay ransoms still fail to recover their data. Ransomware attacks remain widespread, with 27% of firms hit in the past year and 80% paying in hopes of restoration. Experts say recovery often fails due to flawed encryption, corrupted backups and untested recovery plans. Paying rarely resolves the full breach, which may include data theft or GDPR implications. Strong preparation, tested backups, insurance and legal readiness are key to resilience.
Reacting Slowly to a Security Breach Opens up Your Business to More Threats, Report Warns
Barracuda’s latest research finds most organisations suffered at least one email breach in the past year and slow response hugely increases follow-on risk. The report links delayed containment with higher odds of ransomware and material business disruption, including reputational harm and lost opportunities. Small firms are hit hard as recovery costs scale per employee and teams struggle to detect and triage incidents within an hour. The authors call for quicker detection, automation in response and a unified approach to break entire attack chains rather than point-in-time fixes.
SMEs Unprepared to Defend Against Advanced Cyber Threats
Vodafone’s latest report warns that Irish SMEs are struggling to keep pace with AI-driven cyber threats. One in four firms could collapse after a single ransomware attack, and AI-powered scams are expected to drive a 50% rise in attack costs within three years. Only half of SMEs rank cyber security as a top priority, while 69% lack proper safeguards. With attackers cloning voices and creating adaptive malware, Vodafone urges practical defences such as training, multi-factor authentication and partnerships with expert providers.
Source: https://www.techcentral.ie/smes-unprepared-to-defend-against-advanced-cyber-threats/
UK Financial Regulator to Focus on Cyber Defence
The Financial Conduct Authority (FCA) signalled a sharper focus on cyber defence and technology as part of its role in safeguarding national security. Speaking to City leaders, chief executive Nikhil Rathi argued that modern conflict hits balance sheets and markets as much as battlefields, and that the regulator must adapt accordingly. The speech pointed to bolstering operational resilience, tackling systemic tech risks and ensuring boards treat cyber as a strategic threat. Firms should expect closer scrutiny of preparedness and clearer expectations for governance, detection and recovery.
The 10 Biggest Issues CISOs and Cyber Teams Face Today
This piece outlines the pressures security leaders say are hardest right now. Priorities include securing AI infrastructure and data, simplifying sprawling toolsets, addressing talent burnout and budget constraints, and improving basic hygiene while preparing for high-impact incidents. The article stresses that AI use is outpacing guardrails, that misaligned incentives impede progress, and that boards seek clearer metrics tied to business outcomes. Leaders are urged to invest in automation, uplift human factors and embed cyber risk into enterprise decision making with repeatable reporting that executives can act on.
The Cyber Security Perception Gap: Why Executives and Practitioners See Security Differently
The article highlights a widening gap between executive confidence and practitioner reality. Frontline teams report tool complexity, alert fatigue and skills shortages, while leaders assume capabilities are stronger and incidents rarer than they are. The author says this misalignment leads to underfunded controls and delayed responses. Recommendations include rationalising tools, automating routine tasks and establishing common risk language and measures that map to resilience outcomes. Greater transparency on near misses and recovery times is urged so investment tracks real exposure rather than assumed maturity.
Source: https://thehackernews.com/2025/10/the-cybersecurity-perception-gap-why.html
Shadow AI: One In Four Employees Use Unapproved AI Tools, Research Finds
A 1Password report found that 27% of employees use AI tools not approved by their organisation, making shadow AI the second most common form of shadow IT after email. While 73% of workers say their company supports AI use, many bypass policies for convenience or productivity. Risks include data leakage, compliance breaches and malware. The report urges firms to maintain an AI tool inventory, define clear usage policies and limit access to authorised platforms to manage accumulated exposure risks.
Source: https://www.infosecurity-magazine.com/news/shadow-ai-employees-use-unapproved/
LinkedIn Phishing Targets Finance Execs With Fake Board Invites
A phishing campaign on LinkedIn is targeting finance executives with fake invitations to join an investment fund. Messages link to malicious sites that mimic LinkedIn and Microsoft login pages, stealing credentials and session cookies through an adversary-in-the-middle setup. Push Security reports that 34% of phishing attempts now occur outside email, up from under 10% three months ago. Attackers use CAPTCHA and Cloudflare Turnstile to evade scanners. Experts urge executives to verify unexpected LinkedIn messages and avoid clicking shared links.
Social Engineering: Why the ClickFix Malware Attack Just Won’t Go Away
ClickFix remains stubborn because it persuades users to perform the risky action themselves, sidestepping many built-in protections. The article explains how browser prompts trick victims into copying and running commands that fetch malware, and describes FileFix as a related variant that uses File Explorer to trigger the same outcome. As the user initiates execution, technical controls may not trigger, so layered mitigations and user awareness are emphasised. The piece encourages stricter browser security policies and training that flags unusual copy-paste and command execution patterns.
Source: https://www.makeuseof.com/why-clickfix-malware-attack-just-wont-go-away/
New Phishing Attack Using Invisible Characters Hidden in Subject Line
Researchers observed attackers inserting invisible characters into email subject lines that bypass automated filters while appearing normal to users. The technique mixes MIME encoding and Unicode soft hyphens so keyword-based systems miss risky terms. It underscores how social engineering adapts when controls focus on predictable patterns. The article advises updating filter logic to normalise subject strings, strengthening multi-factor authentication, and coaching staff to treat odd formatting as a red flag. It also highlights the need to monitor for anomalies in the way messages appear in different email applications.
Source: https://cybersecuritynews.com/new-phishing-attack-using-invisible-characters/
BT Warns of Soaring Cyber Threats Targeting UK Firms
BT reported a 300% surge in cyber surveillance, with UK businesses now scanned over 4,000 times daily for vulnerabilities. Professional services, retail, and hospitality sectors face the most ransomware activity, with smaller firms hardest hit. BT urges proactive measures to strengthen cyber resilience.
Source: https://www.lawnews.co.uk/cyber/bt-warns-of-soaring-cyber-threats/
Governance, Risk and Compliance
UK financial regulator to focus on cyber defence - UKTN
Enterprises can’t keep a lid on surging cyber incident costs | IT Pro
The Cybersecurity Perception Gap: Why Executives and Practitioners See Risk Differently
CISOs Finally Get a Seat at the Board's Table
BSI Warns of Looming AI Governance Crisis - Infosecurity Magazine
LinkedIn phishing targets finance execs with fake board invites
BT Data Reveals 300% Rise in Cyber Surveillance on Businesses
UK businesses scanned 4000 times a day by hackers - Insurance Post
SMEs unprepared to defend against advanced cyber threats - TechCentral.ie
CFOs Double Down on AI and Cybersecurity as Tariffs Emerge as Major New Threat
Do CISOs need to rethink service provider risk? | CSO Online
The Cybersecurity Shift Every Business Needs to Make Today
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Cyber and AI Oversight Disclosures: What Companies Shared in 2025
70% of CISOs say internal conflicts more damaging than cyberattacks | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware recovery perils: 40% of paying victims still lose their data | CSO Online
Insider Threats Loom while Ransom Payment Rates Plummet - Security Boulevard
QBE predicts 40% rise in ransomware incidents by 2026 | Insurance Times
1 in 4 SMEs face ransomware risk - Shelflife Magazine
New LockBit Ransomware Victims Identified by Security Researchers - Infosecurity Magazine
Why Britain is struggling to stop the ransomware cyberattacks | The Week
Qilin Ransomware Group Publishes Over 40 Cases Monthly - Infosecurity Magazine
Why ransomware group names don’t matter for defense | SC Media
Three Factors Determine Whether a Ransomware Group is Successful - Security Boulevard
Ransomware Hackers Look for New Tactics Amid Falling Profits
Ransomware hackers are now running Linux encryptors in Windows to stay undetected | TechRadar
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc
Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks
Cisco, Citrix and SonicWall VPNs connected to higher risk of ransomware infections | TechRadar
Uncovering Qilin attack methods exposed through multiple cases
Surprised, Not Surprised, Ransomware Attacks Have Ticked Up - Security Boulevard
28% of Irish businesses risk closure with one ransomware attack
Pulling the plug: A way to halt a cyber attacker in your network? | Computer Weekly
Next-gen firewalls, VPNs can increase security risks: At-Bay • The Register
180 ransomware attacks plague education sector worldwide in 2025 through Q3 | K-12 Dive
Ransomware Victims
The costliest cyber attack in UK history | PQ Magazine
New LockBit Ransomware Victims Identified by Security Researchers - Infosecurity Magazine
Russian hackers threaten Dublin Airport | Cybernews
More Collins Aerospace Hacking Fallout - InfoRiskToday
TCS denies losing UK’s Marks & Spencer contract over £300 million cyberattack - The Economic Times
Qilin claims pharmacy benefit manager MedImpact | Cybernews
Ransomware gang claims Conduent breach: what you should watch for next | Malwarebytes
Phishing & Email Based Attacks
LinkedIn phishing targets finance execs with fake board invites
New Phishing Attack Bypasses Using UUIDs Unique to Bypass Secure Email Gateways
New CoPhish attack steals OAuth tokens via Copilot Studio agents
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Fake LastPass death claims used to breach password vaults
How we linked ForumTroll APT to Dante spyware by Memento Labs | Securelist
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
KnowBe4 Uncovers Surged Abuse of Legitimate Platforms by Cybercriminals in 2025
Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation
9 in 10 Exchange servers in Germany are out of support • The Register
ClickFix Infrastructure Surprises Inform Better Blocking
Google disputes false claims of massive Gmail data breach
Other Social Engineering
LinkedIn phishing targets finance execs with fake board invites
This new malware attack just wont go away
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Fake LastPass death claims used to breach password vaults
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
Smishing Triad Linked to 194,000 Malicious Domains in Global Phishing Operation
Hackers Use AI to Supercharge Social Engineering Attacks
ClickFix Infrastructure Surprises Inform Better Blocking
BiDi Swap: The bidirectional text trick that makes fake URLs look real
Google study finds Android avoids 58% more spam and scam texts compared to iOS
ICO fines sole trader for allegedly sending 1M spam texts • The Register
Fraud, Scams and Financial Crime
UK Fraud Cases Surge 17% Annually - Infosecurity Magazine
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
A Quarter of Scam Victims Have Considered Self-Harm - Infosecurity Magazine
Google study finds Android avoids 58% more spam and scam texts compared to iOS
Investment Scams Spread Across Asia With International Reach - Infosecurity Magazine
Artificial Intelligence
New CoPhish attack steals OAuth tokens via Copilot Studio agents
BSI Warns of Looming AI Governance Crisis - Infosecurity Magazine
AI browsers are the next big target for hackers - Cryptopolitan
AI chatbots are sliding toward a privacy crisis - Help Net Security
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Hackers Use AI to Supercharge Social Engineering Attacks
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc
Are AI browsers worth the security risk? Why experts are worried | ZDNET
Dark AI is fueling cybercrime — and accelerating the cybersecurity arms race - Big Think
AI writes code like a junior dev, and security is feeling it - Help Net Security
AI agents can leak company data through simple web searches - Help Net Security
Chatbots parrot Putin propaganda about Ukraine invasion • The Register
Your photo could be all AI needs to clone your voice - Help Net Security
One In Four Employees Use Unapproved AI Tools, Research Finds - Infosecurity Magazine
Get your news from AI? Watch out - it's wrong almost half the time | ZDNET
AI Search Tools Easily Fooled by Fake Content
First Zero Click Attack Exploits MCP and Connected Popular AI Agents To Exfiltrate Data Silently
One week to opt out or be fodder for LinkedIn AI training • The Register
2FA/MFA
X: Re-enroll 2FA security keys by November 10 or get locked out
Malware
This new malware attack just wont go away
Emerging Cyber Threats Featuring QR Codes ClickFix and LOLBins Challenging SOC Defenses
Infostealers Run Wild - DataBreachToday
Hackers steal Discord accounts with RedTiger-based infostealer
Hackers weaponize Telegram messenger with malware to gain system control - Cryptopolitan
Malicious NPM packages fetch infostealer for Windows, Linux, macOS
PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs
Defenses Need to Adapt, Because the Malware Already Did
DDoS, data theft, and malware are storming the gaming industry - Help Net Security
Bots/Botnets
Botnets Step Up Cloud Attacks Via Flaws, Misconfigs
Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices
Mobile
Android malware uses random text delays to look more human • The Register
Massive surge of NFC relay malware steals Europeans’ credit cards
Hackers weaponize Telegram messenger with malware to gain system control - Cryptopolitan
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
Google study finds Android avoids 58% more spam and scam texts compared to iOS
MPs urge UK government to stop phone theft wave through tech • The Register
Why the 5G symbol on your phone doesn't mean you actually have 5G - BBC News
Denial of Service/DoS/DDoS
Security hole slams Chromium browsers - no fix yet • The Register
DDoS, data theft, and malware are storming the gaming industry - Help Net Security
Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed
Internet of Things – IoT
Experts Reports Sharp Increase in Automated Botnet Attacks Targeting PHP Servers and IoT Devices
How neighbors could spy on smart homes - Help Net Security
Data Breaches/Leaks
Infamous Cybercriminal Forum BreachForums Is Back Again With A New Clear Net Domain
List of Oracle EBS Attack Victims May Be Growing Longer
EY exposed 4TB SQL backup file to open web, researchers say • The Register
Hackers steal Discord accounts with RedTiger-based infostealer
F5 asserts limited impact from prolonged nation-state attack on its systems | CyberScoop
Hackers Allegedly Claim Breach Of HSBC USA Customers' Records Including Financial Details
Human impact of UK's Afghan data disaster revealed to MPs • The Register
When 183 Million Passwords Leak: How One Breach Fuels a Global Threat Chain - Security Boulevard
Email breaches are the silent killers of business growth - Help Net Security
First Zero Click Attack Exploits MCP and Connected Popular AI Agents To Exfiltrate Data Silently
Ransomware gang claims Conduent breach: what you should watch for next | Malwarebytes
What to Do About the Massive Gmail Password Data Leak
Marketing giant Dentsu warns staff after Merkle data raid • The Register
Hackers steal data of fashion retailer Mango’s customers • Graham Cluley
DDoS, data theft, and malware are storming the gaming industry - Help Net Security
Iran’s MOIS-linked Ravin Academy hit by data breach • The Register
UK lotto players land data jackpot thanks to website error • The Register
Organised Crime & Criminal Actors
Infamous Cybercriminal Forum BreachForums Is Back Again With A New Clear Net Domain
UK Fraud Cases Surge 17% Annually - Infosecurity Magazine
Insider Threats Loom while Ransom Payment Rates Plummet - Security Boulevard
72 states sign first global UN Convention against Cybercrime - Help Net Security
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
Two U.K. teenagers appear in court over Transport of London cyber attack – DataBreaches.Net
UN Cybercrime Treaty wins dozens of signatories • The Register
Insider Risk and Insider Threats
Insider Threats Loom while Ransom Payment Rates Plummet - Security Boulevard
Insider Threat Prevention - Security Boulevard
Data on Insider Threats Reveal Hidden Risk Patterns
Insurance
Cyber insurance demand rises as global tensions fuel surge in digital threats - BetaNews
New threats spike cyber insurance surge
Supply Chain and Third Parties
Do CISOs need to rethink service provider risk? | CSO Online
NYSDFS Guidance on Managing Risks to Third-Party Service Provider
Google Investigates Weekslong Security Breach Involving Contractor — The Information
UK leads global fight to stop ransomware attacks on supply chains - GOV.UK
Cloud/SaaS
Botnets Step Up Cloud Attacks Via Flaws, Misconfigs
Microsoft: DNS outage impacts Azure and Microsoft 365 services
What to Do About the Massive Gmail Password Data Leak
Germany issues hacked account checklist | Cybernews
Microsoft sued for allegedly tricking millions into Copilot M365 subscriptions
Microsoft Security Change for Azure Creates Pitfalls
Outages
Microsoft: DNS outage impacts Azure and Microsoft 365 services
Identity and Access Management
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Encryption
Chrome to Make HTTPS Mandatory by Default in 2026 - Infosecurity Magazine
Linux and Open Source
Ransomware hackers are now running Linux encryptors in Windows to stay undetected | TechRadar
Ubuntu’s Kernel Vulnerability Let Attackers Escalate Privileges and Gain Root Access
Ultimate Guide to Open Source Security: Risks, Attacks & Defenses - Security Boulevard
Why open source may not survive the rise of generative AI | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
When 183 Million Passwords Leak: How One Breach Fuels a Global Threat Chain - Security Boulevard
Cybercriminals Trade 183 Million Stolen Credentials on Telegram, Dark Forums - SecurityWeek
Social Media
LinkedIn phishing targets finance execs with fake board invites
Germany issues hacked account checklist | Cybernews
X: Re-enroll 2FA security keys by November 10 or get locked out
One week to opt out or be fodder for LinkedIn AI training • The Register
Regulations, Fines and Legislation
UK financial regulator to focus on cyber defence - UKTN
Government Shutdown Creates Lapse in Cyber Threat Information Sharing | Alston & Bird - JDSupra
Shutdown Sparks 85% Increase in US Gov't Cyberattacks
US cybersecurity progress is 'slipping,' report warns | American Banker
72 states sign first global UN Convention against Cybercrime - Help Net Security
UN Cybercrime Treaty wins dozens of signatories • The Register
Navigating EMEA Regulatory Compliance for Critical Infrastructure | IT Pro
Navigating NIS2: What Organisations Need to Know as EU Implementation Unfolds | Goodwin - JDSupra
ICO fines sole trader for allegedly sending 1M spam texts • The Register
New York’s Cyber Rules Ramp Up Pressure on Security Officers
Models, Frameworks and Standards
Navigating NIS2: What Organisations Need to Know as EU Implementation Unfolds | Goodwin - JDSupra
Careers, Working in Cyber and Information Security
Cyber Pros Needed: Securing the Middle Ground
Cross-border cooperation can help to tackle global cyber talent shortage
Top tips to prepare for a cybersecurity job interview
Law Enforcement Action and Take Downs
Infamous Cybercriminal Forum BreachForums Is Back Again With A New Clear Net Domain
Two U.K. teenagers appear in court over Transport of London cyber attack – DataBreaches.Net
72 states sign first global UN Convention against Cybercrime - Help Net Security
UN Cybercrime Treaty wins dozens of signatories • The Register
Europol Warns of Rising Threat From Caller ID Spoofing Attacks - Infosecurity Magazine
Ex-US cyber intel exec pleads guilty to selling spy tools to Russian broker | Reuters
Misinformation, Disinformation and Propaganda
Chatbots parrot Putin propaganda about Ukraine invasion • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
How China really spies on the UK in 2025 - BBC News
‘I am not a robot’: Russian hackers use fake CAPTCHA lures to deploy espionage tools | CSO Online
Shifting from reactive to proactive: Cyber resilience amid nation-state espionage | CyberScoop
Suspected Chinese snoops weaponize unpatched Windows flaw • The Register
Nation State Actors
China
How China really spies on the UK in 2025 - BBC News
F5 asserts limited impact from prolonged nation-state attack on its systems | CyberScoop
CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Suspected Chinese snoops weaponize unpatched Windows flaw • The Register
Britain Needs China’s Money. It Fears What Comes With It. - The New York Times
US company with access to biggest telecom firms uncovers breach by nation-state hackers | Reuters
China-linked hackers exploit patched ToolShell flaw to breach Middle East telecom
US Government Urges Total Ban of Our Most Popular Wi-Fi Router - CNET
Russia
‘I am not a robot’: Russian hackers use fake CAPTCHA lures to deploy espionage tools | CSO Online
Sanctions won’t stop cyberattacks, but they can still "bite" - Help Net Security
Chatbots parrot Putin propaganda about Ukraine invasion • The Register
Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks
Nation-State Cyber Ecosystems Weakened by Sanctions, Report Reveals - Infosecurity Magazine
Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets
Ex-US cyber intel exec pleads guilty to selling spy tools to Russian broker | Reuters
NBC Weapons: Russia Resorts to Chemical Warfare
Russian Rosselkhoznadzor hit by DDoS attack, food shipments across Russia delayed
Iran
Iran’s MOIS-linked Ravin Academy hit by data breach • The Register
North Korea
North Korean Hackers Attacking Unmanned Aerial Vehicle Industry to Steal Confidential Data
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign
SideWinder Hacking Group Uses ClickOnce-Based Infection Chain to Deploy StealerBot Malware
How we linked ForumTroll APT to Dante spyware by Memento Labs | Securelist
Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware
Tools and Controls
AI browsers are the next big target for hackers - Cryptopolitan
AI writes code like a junior dev, and security is feeling it - Help Net Security
Shifting from reactive to proactive: Cyber resilience amid nation-state espionage | CyberScoop
Active Directory at Risk Due to Domain-Join Account Misconfigurations
Cyber insurance demand rises as global tensions fuel surge in digital threats - BetaNews
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Are AI browsers worth the security risk? Why experts are worried | ZDNET
AI browsers are a cybersecurity time bomb | The Verge
Cisco, Citrix and SonicWall VPNs connected to higher risk of ransomware infections | TechRadar
CFOs Double Down on AI and Cybersecurity as Tariffs Emerge as Major New Threat
Digital Risk Management Strategies
Why Early Threat Detection Is a Must for Long-Term Business Growth
The State of Exposure Management in 2025: Insights From 3,000+ Organizations
NYSDFS Guidance on Managing Risks to Third-Party Service Provider
Pulling the plug: A way to halt a cyber attacker in your network? | Computer Weekly
Next-gen firewalls, VPNs can increase security risks: At-Bay • The Register
Mozilla: New Firefox extensions must disclose data collection practices
CISA and NSA share tips on securing Microsoft Exchange servers
US Government Urges Total Ban of Our Most Popular Wi-Fi Router - CNET
Vulnerability Management
The State of Exposure Management in 2025: Insights From 3,000+ Organizations
Ultimate Guide to Open Source Security: Risks, Attacks & Defenses - Security Boulevard
9 in 10 Exchange servers in Germany are out of support • The Register
NHS quarantines devices as suppliers drag feet on Windows 11 • The Register
Vulnerabilities
List of Oracle EBS Attack Victims May Be Growing Longer
Microsoft Issues Emergency Patch for Windows Server Bug
CVE-2025-59287: Microsoft fixes critical WSUS flaw under active attack
Microsoft WSUS attacks hit 'multiple' orgs, Google warns • The Register
CISA Flags VMware Zero-Day Exploited by China-Linked Hackers in Active Attacks
Suspected Chinese snoops weaponize unpatched Windows flaw • The Register
Ubuntu’s Kernel Vulnerability Let Attackers Escalate Privileges and Gain Root Access
Multiple Oracle VM VirtualBox Vulnerabilities Enables Complete Takeover Of VirtualBox
Year-Old WordPress Plugin Flaws Exploited to Hack Websites - SecurityWeek
Apache Tomcat Security Vulnerabilities Expose Servers to Remote Code Execution Attacks
OpenVPN Vulnerability Exposes Linux, MacOS Systems To Script Injection Attacks
New "Brash" Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL
Chrome Zero-Day Exploited to Deliver Italian Memento Labs' LeetAgent Spyware
Security hole slams Chromium browsers - no fix yet • The Register
Chrome 0-Day Vulnerability Actively Exploited in Attacks by Notorious Hacker Group
QNAP warns of critical ASP.NET flaw in its Windows backup software
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 24 October 2025
Black Arrow Cyber Threat Intelligence Briefing 24 October 2025:
-GCHQ Says Boards Must Understand Cyber Risks and Prepare for Attacks That Get Through
-Study Reveals Cyber Confidence Often Misaligned with Reality
-Threat Actors Exploiting Faster Than Businesses Can Respond
-Millions Still Use One Password Across Multiple Accounts
-Microsoft Warns of Sharp Rise in Identity Attacks Driven by Password Theft
-Insider Risks Cause Data Loss in 77% of Organisations
-AI-Driven Threats Are Top Concern for Cyber Professionals in 2026
-Infostealers Are Reshaping the Cyber Security Landscape
-How ClickFix Attackers Trick You to Attack Yourself and Bypass Your Security
-Business Confidence in Ransomware Defence Is High, But Readiness Is Low
-Ransomware Payouts Surge to $36M in Recent Cases
-Third-Party Breaches Escalate as Confidence Gap Widens Among Cyber Leaders
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week, the head of GCHQ has urged businesses to ensure their boards include members who understand cyber risks and can ask the right questions, while a new report highlights that many organisations are misaligned in their perception of cyber security strength versus actual security.
We also include a reminder about one of the most basic cyber controls: passwords. Millions of users have a single password for multiple accounts, and Microsoft warns of a rise in attacks driven by password theft. Our other insights include attackers exploiting vulnerabilities within days and using AI to scale their impact, the rising threat of ransomware, and the broader consequences of business leaders not recognising the gaps in their defences including the importance of testing incident response plans.
Responding to the above GCHQ call to action, contact us to learn how we support our client boards in their cyber governance and compliance. We join regular board meetings to lead the conversation on progress in building stronger and proportionate cyber security, while upskilling board members to support continuous development.
Top Cyber Stories of the Last Week
GCHQ Says Boards Must Understand Cyber Risks and Prepare for Attacks That Get Through
The head of GCHQ has urged UK companies to prepare for inevitable cyber-attacks by developing contingency plans that include offline crisis protocols. Speaking at a cyber security conference, Anne Keast-Butler stressed that boards must include members who understand cyber risks and can ask the right questions. She highlighted the increasing frequency of significant attacks and the role of AI in lowering the barrier for malicious actors. The National Cyber Security Centre reported a sharp rise in major incidents, and underscored the need for rehearsed response strategies by leadership teams.
Source: https://www.theguardian.com/technology/2025/oct/23/gchq-companies-cyber-crime-threat
Study Reveals Cyber Confidence Often Misaligned with Reality
A new report highlights a gap between perceived cyber security strength and actual readiness. Many organisations believe they are well protected, yet lack basic controls such as multi-factor authentication and incident response testing. The analysis shows that overconfidence can lead to underinvestment in critical areas. Experts urge boards to validate their assumptions through independent assessments and to ensure that cyber security is governed like other enterprise risks. The findings reinforce the need for leadership accountability and continuous improvement.
Source: https://professionalsecurity.co.uk/products/cyber/confidence-and-reality/
Threat Actors Exploiting Faster Than Businesses Can Respond
Threat actors are now exploiting vulnerabilities within days of discovery, leaving businesses with little time to react. The article outlines how attackers use automation and AI to identify and weaponise weaknesses rapidly. Business leaders are urged to shorten patch cycles, improve threat intelligence sharing, and rehearse incident response. The piece emphasises that cyber resilience is no longer just a technical issue but a leadership challenge requiring proactive governance and investment in agility.
Millions Still Use One Password Across Multiple Accounts
A new study reveals that millions of users continue to rely on a single password for multiple accounts, despite years of awareness campaigns. The report finds that 31% of respondents reuse passwords across work and personal platforms, creating major risks for credential stuffing and account takeover. The article calls for stronger enforcement of password policies and wider adoption of password managers. It also highlights the need for leadership to model good behaviour and ensure staff receive regular training.
Source: https://cybernews.com/security/millions-use-one-password/
Microsoft Warns of Sharp Rise in Identity Attacks Driven by Password Theft
Microsoft has reported a 32% increase in identity-based cyber attacks in the first half of 2025, with over 97% involving password-based methods. According to its latest Digital Defense Report, attackers are increasingly using stolen credentials to impersonate employees or contractors, often leading to data theft and ransomware deployment. Infostealer malware and help desk scams are key tactics, with groups like Scattered Spider exploiting these methods. Microsoft also highlighted its efforts to disrupt threats such as Lumma Stealer and cracked Cobalt Strike tools. IT firms and government bodies remain top targets, while ransomware actors are increasingly abusing antivirus exclusions to bypass defences.
Source: https://therecord.media/microsoft-warns-of-surge-identity-hacks-passwords
Insider Risks Cause Data Loss in 77% of Organisations
A study finds that 77% of organisations have experienced data loss due to insider risks, including negligent or malicious behaviour. Security leaders cite lack of visibility and poor access controls as key contributors. The report stresses the importance of behavioural monitoring, role-based access, and staff awareness programmes. Insider threats are often overlooked compared to external attacks, yet they pose significant operational and reputational risks. Boards are advised to treat insider risk as a strategic issue requiring cross-functional governance.
AI-Driven Threats Are Top Concern for Cyber Professionals in 2026
New research from ISACA finds that AI-driven threats are the biggest concern for cyber security professionals heading into 2026. The survey reveals that 62% of respondents expect AI to increase the volume and sophistication of attacks. Concerns include deepfakes, automated phishing, and AI-powered malware. The report also notes a gap in preparedness, with only 38% of organisations confident in their ability to defend against AI-enabled threats. The findings call for urgent investment in AI-aware defences and leadership engagement on emerging risks.
Infostealers Are Reshaping the Cyber Security Landscape
Infostealers are a type of malware designed to silently collect credentials, session tokens and sensitive data from infected devices. These tools are increasingly used by attackers to bypass multi-factor authentication and gain persistent access to cloud services. Unlike ransomware, infostealers operate quietly, often going undetected while harvesting data for later use or sale. The rise of malware-as-a-service has made infostealers widely accessible, with criminal groups offering subscription models. Experts urge organisations to monitor for unusual login patterns and to implement stronger endpoint protection. The trend reflects a shift from disruptive attacks to silent data theft.
Source: https://betanews.com/2025/10/22/how-infostealers-have-changed-the-cybersecurity-landscape/
How ClickFix Attackers Trick You to Attack Yourself and Bypass Your Security
ClickFix is an attack method that pretends to be a fix for a broken page or a CAPTCHA, but in reality tricks users into copying and pasting malicious code from their browser clipboard. These attacks bypass email filters and rely on SEO poisoning and malvertising to lure victims. SEO poisoning involves attackers manipulating search engine results so that malicious websites appear high in search rankings, often mimicking legitimate help pages or software fixes. Once executed, the code runs locally and often evades endpoint detection. ClickFix has been linked to ransomware groups and state actors, with recent incidents affecting healthcare and municipal systems. The attack uses obfuscated JavaScript and legitimate-looking sites, making detection difficult.
Source: https://www.thehackernews.com/2025/10/analysing-clickfix-3-reasons-why.html
Business Confidence in Ransomware Defence Is High, But Readiness Is Low
A report finds a disconnect between business confidence and actual preparedness for ransomware attacks. While 70% of executives believe their organisations are well protected, only 35% have tested incident response plans. The report shows that attackers are evolving faster than defences, with double extortion and data theft now common tactics. The findings suggest that leadership needs to challenge its own evaluation and invest in practical resilience measures, including tabletop exercises and supplier coordination.
Ransomware Payouts Surge to $36M in Recent Cases
New data shows that ransomware payouts have surged, with recent cases totalling $36M. Attackers use double extortion tactics, demanding payment not only to decrypt data but also to prevent public exposure. The report highlights that many victims are SMEs with limited recovery options. Experts warn that paying ransoms often leads to further demands and does not guarantee full restoration. The findings support calls for stronger backup strategies and rehearsals of how to manage being attacked.
Source: https://www.infosecurity-magazine.com/news/ransomware-payouts-surge-dollar36m/
Third-Party Breaches Escalate as Confidence Gap Widens Among Cyber Leaders
Experts warn that third-party and supply chain breaches are spiralling out of control, with 60% of UK and US leaders admitting the risks are too complex to manage. Despite 97% expressing confidence in breach response, 61% reported suffering a third-party attack in the past year. The IO State of Information Security Report highlights incidents such as those at Jaguar Land Rover and Collins Aerospace, showing how supply chain compromise can cause widespread disruption. Smaller firms are increasingly targeted, yet only 23% of leaders ranked supply chain compromise among their top emerging threats.
Source: https://www.emergingrisks.co.uk/third-party-breaches-out-of-control-experts-warn/
Governance, Risk and Compliance
"We Are Very Exposed": Does The UK Need A New Plan For Cyber-Attacks?
Cyber security is business survival - NCSC.GOV.UK
Confidence and reality | Professional Security Magazine
2025 Cyber Incident Trends: What Your Business Needs to Know | Mayer Brown - JDSupra
Why Political Risk Is Now A Top Threat For Companies
62% of Risk Leaders Say Trade Wars Could Trigger Cyberattacks, New Riskonnect Research Finds
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Payouts Surge to $3.6m Amid Evolving Tactics - Infosecurity Magazine
Ransomware Reality: Business Confidence Is High, Preparedness Is Low
Scattered Lapsus$ Hunters Signal Shift in Tactics - Infosecurity Magazine
Madman Theory Spurs Crazy Scattered Lapsus$ Hunters Playbook
Warlock Ransomware: Old Actor, New Tricks? | SECURITY.COM
Japanese companies brace themselves for more attacks as cybercrimes climb | The Straits Times
Ransomware Victims
JLR hack 'is costliest cyber attack in UK history', experts say - BBC News
Jaguar Land Rover cyberattack could cost the UK almost £2B • The Register
UK Ministry of Defense Probes Military Contractor Data Leak
UK vehicle output drops by 36% following JLR cyber attack | Autocar
Japanese retailer Muji halted online sales after a ransomware attack on logistics partner
Golfwear giant allegedly targeted by Russian hackers | Cybernews
Phishing & Email Based Attacks
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches
This new cyberattack tricks you into hacking yourself. Here's how to spot it | ZDNET
How AI is driving email phishing and how to beat the threat [Q&A] - BetaNews
Many IT leaders click phishing links — and some don’t report them | CIO Dive
New Phishing Attack Leverages Azure Blob Storage to Impersonate Microsoft
TikTok videos continue to push infostealers in ClickFix attacks
John Bolton charged over classified emails after Iranian hack of his AOL account
PhantomCaptcha ClickFix attack targets Ukraine war relief orgs
New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs
Other Social Engineering
Analysing ClickFix: 3 Reasons Why Copy/Paste Attacks Are Driving Security Breaches
AI Social Engineering Top Cyber Threat for 2026, ISACA Survey Reveals - Infosecurity Magazine
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Google and Check Point nuke massive YouTube malware network • The Register
Researchers track surge in high-level Smishing Triad activity | CyberScoop
TikTok videos continue to push infostealers in ClickFix attacks
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
Fraud, Scams and Financial Crime
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Google and Check Point nuke massive YouTube malware network • The Register
Researchers track surge in high-level Smishing Triad activity | CyberScoop
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide
131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign
Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People - SecurityWeek
First conviction for promoting tax fraud on Instagram | HM Revenue & Customs (HMRC)
Cifas exposes dozens of email addresses in invite mishap • The Register
Artificial Intelligence
How AI is driving email phishing and how to beat the threat [Q&A] - BetaNews
Executives Fear AI Cyber Threats Could Outpace Defenses
Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US - SecurityWeek
Companies want the benefits of AI without the cyber blowback - Help Net Security
Survey: Cybersecurity Teams Struggling to Keep Pace in the Age of AI - Security Boulevard
It Takes Only 250 Documents to Poison Any AI Model
AI Sidebar Spoofing Puts ChatGPT Atlas, Perplexity Comet and Other Browsers at Risk - SecurityWeek
Malware
How infostealers have changed the cybersecurity landscape - BetaNews
Lumma Stealer Vacuum Filled by Upgraded Vidar 2.0 Infostealer - Infosecurity Magazine
Threat Actors With Stealer Malwares Processing Millions of Credentials a Day - Cyber Security News
Why traditional bot defenses are failing in the age of intelligent automation | TechRadar
Google and Check Point nuke massive YouTube malware network • The Register
TikTok videos continue to push infostealers in ClickFix attacks
North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware
Vidar Stealer 2.0 adds multi-threaded data theft, better evasion
Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure
Cybercriminals turn to stealth to bypass malware detection - BetaNews
Security Teams Must Deploy Anti-Infostealer Defenses Now - Infosecurity Magazine
Google ads for fake Homebrew, LogMeIn sites push infostealers
Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers
Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
Cyber-criminals turn on each other: the story of Lumma Stealer's collapse | Fortra
Iranian hackers targeted over 100 govt orgs with Phoenix backdoor
Official Xubuntu website compromised to serve malware - Help Net Security
New .NET CAPI Backdoor Targets Russian Auto and E-Commerce Firms via Phishing ZIPs
Bots/Botnets
Why traditional bot defenses are failing in the age of intelligent automation | TechRadar
Mobile
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide
131 Chrome Extensions Caught Hijacking WhatsApp Web for Massive Spam Campaign
EU watchdog attacks Britain over iPhone ‘backdoor’ demand
Why Some Apps Ask for Contacts (and What They Actually Do With Them)
6 steps to increase Android security in the enterprise | TechTarget
Denial of Service/DoS/DDoS
How to Detect and Mitigate Hit and Run DDoS Attacks - Security Boulevard
Cache poisoning vulnerabilities found in 2 DNS resolving apps - Ars Technica
Multiple Gitlab Security Vulnerabilities Let Attackers Trigger DoS Condition
Internet of Things – IoT
Is Your Car a BYOD Risk? Researchers Demonstrate How
Your smart building isn't so smart without security - Help Net Security
When everything's connected, everything's at risk - Help Net Security
Bombarding Cars With Lasers: Novel Auto Attacks Emerge
Data Breaches/Leaks
Over 266,000 F5 BIG-IP instances exposed to remote attacks
Hackers Had Been Lurking in Cyber Firm F5 Systems Since 2023
F5 Networks Breach: A Wake-Up Call for Supply Chain Cybersecurity - Security Boulevard
183 million email accounts just got compromised. Check if you're affected | PCWorld
ICO defends decision not to investigate MoD Afghan data leak • The Register
FinWise data breach shows why encryption is your last defense
John Bolton charged over classified emails after Iranian hack of his AOL account
MoD probes claims Russian hackers stole files on bases - BBC News
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws | CSO Online
Cifas exposes dozens of email addresses in invite mishap • The Register
American Airlines Subsidiary Envoy Air Hit by Oracle Hack - SecurityWeek
Hundreds of masked ICE agents doxxed by hackers, as personal details posted on Telegram
Organised Crime & Criminal Actors
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People - SecurityWeek
Hackers Attacking Remote Desktop Protocol Services With 30,000+ New IP Addresses Daily
Russian Government Now Actively Managing Cybercrime Groups: Security Firm - SecurityWeek
Cyber-criminals turn on each other: the story of Lumma Stealer's collapse | Fortra
Not Just Spies: Satellite Operators Say Cybercrime Is Major Threat
Russia Pivots, Cracks Down on Resident Hackers
Ex-Uber CSO talks teen cyber crims, CISO role with The Reg • The Register
Insider Risk and Insider Threats
Security Leaders Share Why 77% Organizations Lose Data Due to Insider Risks | Security Magazine
Are we human or are we security risk? - BetaNews
Insurance
Cyber war perception hindering capital and market growth: Johansmeyer at Convergence - Artemis.bm
Supply Chain and Third Parties
JLR hack 'is costliest cyber attack in UK history', experts say - BBC News
The next cyber crisis may start in someone else's supply chain - Help Net Security
Third party breaches out of control experts warn
F5 Networks Breach: A Wake-Up Call for Supply Chain Cybersecurity - Security Boulevard
UK Ministry of Defense Probes Military Contractor Data Leak
Third-Party Breaches: Why Vendor Passwords Put Your Organization at Risk - Security Boulevard
Japanese retailer Muji halted online sales after a ransomware attack on logistics partner
American Airlines subsidiary Envoy confirms Oracle data theft attack
Cloud/SaaS
AWS outage crashes Amazon, PrimeVideo, Fortnite, Perplexity and more
AWS Outage: Billions Lost, Multi-Cloud Is Wall Street’s Solution
Cybersecurity expert offers blunt verdict on AWS outage - TheStreet
AWS outage exposes Achilles heel: central control plane • The Register
What the Huge AWS Outage Reveals About the Internet | WIRED
Amazon cloud outage fuels call for Europe to limit reliance on US tech – POLITICO
CyberCube estimates preliminary AWS outage loss range of $38-581m - Reinsurance News
Inside the messy reality of Microsoft 365 management - Help Net Security
Zoom isn't as private as you think. Here's how to lock it down | PCWorld
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws | CSO Online
Outages
AWS outage crashes Amazon, PrimeVideo, Fortnite, Perplexity and more
Cybersecurity expert offers blunt verdict on AWS outage - TheStreet
AWS outage exposes Achilles heel: central control plane • The Register
What the Huge AWS Outage Reveals About the Internet | WIRED
Amazon cloud outage fuels call for Europe to limit reliance on US tech – POLITICO
Identity and Access Management
Encryption
EU watchdog attacks Britain over iPhone ‘backdoor’ demand
FinWise data breach shows why encryption is your last defense
Linux and Open Source
Europe's plan to ditch US tech giants is built on open source - and it's gaining steam | ZDNET
Amazon cloud outage fuels call for Europe to limit reliance on US tech – POLITICO
Official Xubuntu website compromised to serve malware - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Threat Actors With Stealer Malwares Processing Millions of Credentials a Day - Cyber Security News
Millions rely on just one password for everything | Cybernews
Third-Party Breaches: Why Vendor Passwords Put Your Organization at Risk - Security Boulevard
183 million email accounts just got compromised. Check if you're affected | PCWorld
Social Media
Google and Check Point nuke massive YouTube malware network • The Register
Dissecting YouTube’s Malware Distribution Network - Check Point Research
Don't be fooled by this massive YouTube scam network - how to protect yourself | ZDNET
TikTok videos continue to push infostealers in ClickFix attacks
First conviction for promoting tax fraud on Instagram | HM Revenue & Customs (HMRC)
Training, Education and Awareness
Phishing training needs a new hook — here’s how to rethink your approach | CSO Online
Regulations, Fines and Legislation
UK cyber law delays 'deeply concerning,' say MPs | The Record from Recorded Future News
Experian fined $3.2 million for mass-collecting personal data
EU watchdog attacks Britain over iPhone ‘backdoor’ demand
ICO defends decision not to investigate MoD Afghan data leak • The Register
US ‘slipping’ on cybersecurity, annual Cyberspace Solarium Commission report concludes | CyberScoop
Behind the struggle for control of the CVE program | CyberScoop
The US government shutdown is a wake-up call for cyber self-reliance | Computer Weekly
Trump's workforce cuts blamed as America's cyber edge dulls • The Register
Models, Frameworks and Standards
Experian fined $3.2 million for mass-collecting personal data
Careers, Working in Cyber and Information Security
Future Cybersecurity Workforce: Beyond Degrees, Toward Durable Skills
Why ex-military professionals are a good fit for cybersecurity - Help Net Security
Hiring Won’t Fix the Cyber Talent Gap: Building a Self-Improving Workforce Will
Law Enforcement Action and Take Downs
Europol dismantles cybercrime network linked to $5.8M in financial losses | CyberScoop
Myanmar Military Shuts Down Major Cybercrime Center and Detains Over 2,000 People - SecurityWeek
Europol Dismantles SIM Farm Network Powering 49 Million Fake Accounts Worldwide
Former Director at US Hacking Tool Provider May Have Sold Secrets to Russia
First conviction for promoting tax fraud on Instagram | HM Revenue & Customs (HMRC)
Three arrested in UK on suspicion of assisting Russian intelligence service | UK news | The Guardian
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns | Trend Micro (US)
Electronic Warfare Puts Commercial GPS Users on Notice
Cyberespionage campaign PassiveNeuron targets machines running Windows Server | Securelist
The UK military says Russia targets its satellites on a weekly basis. What can be done about it?
Are we already witnessing space warfare in action: 'This is not just posturing' | Space
Cyber war perception hindering capital and market growth: Johansmeyer at Convergence - Artemis.bm
China
Hackers Had Been Lurking in Cyber Firm F5 Systems Since 2023
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns | Trend Micro (US)
Salt Typhoon Uses Citrix Flaw in Global Cyber-Attack - Infosecurity Magazine
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
Reconfiguring U.S. Cyber Strategy in the Wake of Salt Typhoon | Lawfare
Researchers track surge in high-level Smishing Triad activity | CyberScoop
China accuses US of cyberattack on national time center | AP News
Russia
Russian Government Now Actively Managing Cybercrime Groups: Security Firm - SecurityWeek
Microsoft: Russia, China Increasingly Using AI to Escalate Cyberattacks on the US - SecurityWeek
Russia-linked COLDRIVER speeds up malware evolution after LOSTKEYS exposure
The UK military says Russia targets its satellites on a weekly basis. What can be done about it?
MoD probes claims Russian hackers stole files on bases - BBC News
Teen Tied to Russian Hackers in Dutch Cyber Espionage Probe - Infosecurity Magazine
EU and Ukraine deepen cooperation on cyber security - EU NEIGHBOURS east
Former Director at US Hacking Tool Provider May Have Sold Secrets to Russia
Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files
Three arrested in UK on suspicion of assisting Russian intelligence service | UK news | The Guardian
PhantomCaptcha ClickFix attack targets Ukraine war relief orgs
Russia-linked hackers claim responsibility for Collins Aerospace cyber attack - Defence Connect
Golfwear giant allegedly targeted by Russian hackers | Cybernews
Iran
John Bolton charged over classified emails after Iranian hack of his AOL account
MuddyWater Targets 100+ MEA Gov Entites With Backdoor
Iranian hackers targeted over 100 govt orgs with Phoenix backdoor
North Korea
North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware
How Lazarus Group used fake job ads to spy on Europe's drone and defense sector - Help Net Security
Lazarus Group Hunts European Drone Manufacturing Data
The Leak That Targeted the Leakers
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
How Business Leaders Can Turn Geopolitical Uncertainty Into Strategic Opportunity
Tools and Controls
Why traditional bot defenses are failing in the age of intelligent automation | TechRadar
How infostealers have changed the cybersecurity landscape - BetaNews
Executives Fear AI Cyber Threats Could Outpace Defenses
Hackers Attacking Remote Desktop Protocol Services With 30,000+ New IP Addresses Daily
Cybercriminals turn to stealth to bypass malware detection - BetaNews
Security Teams Must Deploy Anti-Infostealer Defenses Now - Infosecurity Magazine
Securing AI to Benefit from AI
Network security devices endanger orgs with ’90s era flaws | CSO Online
Is EDR Giving You a False Sense of Security? - Infosecurity Magazine
Microsoft disables File Explorer preview for downloads to block attacks
Zero Trust Has a Blind Spot—Your AI Agents
When Your Backups Become the Target: Building Cyber Resilience That Lasts | Dell
Former Director at US Hacking Tool Provider May Have Sold Secrets to Russia
CISOs’ security priorities reveal an augmented cyber agenda | CSO Online
China accuses US of cyberattack on national time center | AP News
Reports Published in the Last Week
Other News
"We Are Very Exposed": Does The UK Need A New Plan For Cyber-Attacks?
Cyber security is business survival - NCSC.GOV.UK
Cyber resilience of UK digital infrastructure - POST
Electronic Warfare Puts Commercial GPS Users on Notice
Not Just Spies: Satellite Operators Say Cybercrime Is Major Threat
IT strategy needs proactive reboot | Professional Security Magazine
Why Political Risk Is Now A Top Threat For Companies
62% of Risk Leaders Say Trade Wars Could Trigger Cyberattacks, New Riskonnect Research Finds
UK launches global cyber standards backed by international partners - UKTN
Vulnerability Management
Threat actors are exploiting flaws more quickly – here's what business leaders should do | IT Pro
Network security devices endanger orgs with ’90s era flaws | CSO Online
Behind the struggle for control of the CVE program | CyberScoop
Flawed Vendor Guidance Exposes Orgs to Avoidable Risk
Vulnerabilities
Over 266,000 F5 BIG-IP instances exposed to remote attacks
Flawed Vendor Guidance Exposes Orgs to Avoidable Risk
Microsoft fixes Windows bug breaking localhost HTTP connections
ConnectWise Patches Critical Flaw in Automate RMM Tool - SecurityWeek
Microsoft fixes one of its "highest ever" rated security flaws - here's what happened | TechRadar
Microsoft fixes Windows Server Active Directory sync issues
CISA: High-severity Windows SMB flaw now exploited in attacks
CISA Confirms Exploitation of Latest Oracle EBS Vulnerability - SecurityWeek
Oracle Releases October 2025 Patches - SecurityWeek
Windows Server emergency patches fix WSUS bug with PoC exploit
BIND Updates Address High-Severity Cache Poisoning Flaws - SecurityWeek
Cache poisoning vulnerabilities found in 2 DNS resolving apps - Ars Technica
Multiple Gitlab Security Vulnerabilities Let Attackers Trigger DoS Condition
71,000+ WatchGuard Devices Vulnerable to Remote Code Execution Attacks
Researchers uncover remote code execution flaw in abandoned Rust code library | CyberScoop
Over 250 Magento Stores Hit Overnight as Hackers Exploit New Adobe Commerce Flaw
Salt Typhoon Uses Citrix Flaw in Global Cyber-Attack - Infosecurity Magazine
Hackers Used Snappybee Malware and Citrix Flaw to Breach European Telecom Network
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws | CSO Online
TP-Link Patches Four Omada Gateway Flaws, Two Allow Remote Code Execution
Cursor, Windsurf IDEs riddled with 94+ n-day Chromium vulnerabilities
Microsoft fixes bug preventing users from opening classic Outlook
HP pulls update that broke Microsoft Entra ID auth on some AI PCs
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 17 October 2025
Black Arrow Cyber Threat Intelligence Briefing 17 October 2025:
-CISOs Urged to Rethink Tabletop Exercises as Most Incidents Are Unrehearsed
-Co-op CEO: Cyber Responsibility Lies with Senior Leaders
-UK Government: Businesses Must Prepare for Total IT Failure
-UK Security Agency Reports Sharp Rise in Cyber Attacks
-Attackers Use Valid Credentials to Breach SonicWall VPNs
-F5 Networks Confirms Long-Term Breach by Government Hackers
-Extortion Group Publishes Data from Salesforce Customer Breaches
-Microsoft: Over Half of Cyber Attacks Driven by Extortion or Ransomware
-Ransomware Attacks Surge 36% in Q3
-North Korean Attackers Use Blockchain to Evade Detection
-Russian Cyber Attacks Against NATO States Rise by 25%
-US Authorities Seize $15 Billion in Bitcoin from Crypto Scam Network
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week the UK government has given strong and clear instructions for all business leaders to plan for a cyber attack. In particular, businesses are urged to prepare for a total failure of their IT, and the CEO of UK retailer Co-op has shared her personal experience to reinforce the message, while the UK security agency reports a sharp rise in attacks.
The fallout of recent attacks is also in the media, including for users of SonicWall and Salesforce, and the continued effects of ransomware and other attacks including by nation states as well as by criminal gangs.
These themes highlight the need for cyber resilience as well as cyber security. Contact us to discuss how to achieve this in a proportionate way, including through our impartial incident response exercise simulations that are tailored to help you better manage an incident with your chosen IT and other control providers.
Top Cyber Stories of the Last Week
CISOs Urged to Rethink Tabletop Exercises as Most Incidents Are Unrehearsed
A new report reveals that 57% of major cyber incidents involved scenarios that organisations had never rehearsed. Experts argue that tabletop exercises often focus on dramatic breaches rather than realistic, subtle attack methods like lateral movement or quiet data exfiltration. Analysts recommend tailoring exercises to the organisation’s threat profile and ensuring practical readiness, such as verifying contact lists and backup communication tools. The findings highlight the need for continuous, realistic simulations that build muscle memory and align security teams with business operations.
Co-op CEO: Cyber Responsibility Lies with Senior Leaders
Following a major breach affecting 6.5 million members, the CEO of UK retailer the Co-operative has called on business leaders to take direct responsibility for cyber resilience. The attack disrupted payments and operations across the group’s businesses. In a letter published in the NCSC’s annual report, she emphasised that drills are essential and urged others to plan for continuity.
UK Government: Businesses Must Prepare for Total IT Failure
The UK National Cyber Security Centre’s annual review warns that the UK now faces four nationally significant cyber attacks per week, a 129% increase from last year. The agency urges organisations to prepare for scenarios where all IT systems are offline, including email and cloud services. Businesses should ensure their crisis plans are available in printed form, and have offline communication methods available. The report distinguishes between backups and resilience, stressing that continuity planning must assume IT failure.
Source: https://www.fortra.com/blog/ncsc-warns-companies-prepare-screens-dark
UK Security Agency Reports Sharp Rise in Cyber Attacks
The UK’s national cyber agency has reported a significant increase in cyber attacks over the past year. Threats include ransomware and state-linked espionage. The report urges organisations to improve basic cyber hygiene and prepare for incidents that may disrupt operations.
Attackers Use Valid Credentials to Breach SonicWall VPNs
Threat actors are actively exploiting SonicWall Secure Mobile Access (SMA) appliances by using valid credentials to gain unauthorised access. Once inside, they deploy malware and establish persistence. The campaign has affected organisations across multiple sectors and demonstrates the risks of credential-based access and MFA bypass.
F5 Networks Confirms Long-Term Breach by Government Hackers
Cyber security firm F5 Networks disclosed that government-backed hackers had persistent access to its systems, stealing source code and customer configuration data. The attackers infiltrated development environments and knowledge systems, exposing undisclosed vulnerabilities. Although no software was modified, the stolen data could help attackers exploit customer systems. The US Department of Justice allowed F5 to delay public disclosure due to national security concerns. The UK’s NCSC and US CISA have urged immediate patching of affected systems.
Extortion Group Publishes Data from Salesforce Customer Breaches
An extortion group known as Scattered LAPSUS$ Hunters, has leaked millions of records allegedly stolen from organisations using Salesforce services. The attackers claimed to have targeted 39 Salesforce customers, but only published data from six, including Qantas, Vietnam Airlines, and GAP. The leaked information includes names, email addresses, phone numbers, dates of birth, and loyalty program details. In one case, attackers accessed data via a third-party contact centre platform. Salesforce denied involvement, stating the incident relates to past or unsubstantiated events.
Source: https://www.securityweek.com/extortion-group-leaks-millions-of-records-from-salesforce-hacks/
Microsoft: Over Half of Cyber Attacks Driven by Extortion or Ransomware
Microsoft’s latest Digital Defence Report finds that 52% of cyber attacks with known motives were financially driven, primarily through extortion and ransomware. The report highlights the growing use of AI by attackers to automate phishing, scale social engineering and develop adaptive malware. Nation-state threats remain persistent, with China, Iran, Russia and North Korea expanding their targets. Microsoft urges leaders to treat cyber security as a strategic priority and adopt phishing-resistant MFA, which can block over 99% of identity-based attacks.
Source: https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/
Ransomware Attacks Surge 36% in Q3
New data shows a 36% year-on-year rise in ransomware attacks during Q3, with 270 publicly disclosed incidents. The emergence of 18 new ransomware groups, including DEVMAN, signals growing threat diversity. Attackers are increasingly targeting sensitive data, including children’s records, and demanding record ransoms. Experts stress the need for data protection to reduce extortion leverage and discourage repeat attacks.
Source: https://betanews.com/2025/10/16/q3-ransomware-attacks-up-36-percent-year-on-year/
North Korean Attackers Use Blockchain to Evade Detection
Researchers from Cisco Talos and Google have uncovered new malware techniques used by North Korean threat actors, including EtherHiding, which leverages public blockchains for command and control. The campaign involves fake job interviews and technical assessments that trick victims into downloading malware. The malware includes keylogging and screenshot modules, enabling persistent access and data theft. These evasive methods make takedown efforts more difficult and signal a shift in nation-state tactics.
Source: https://cyberscoop.com/north-korea-attackers-evasive-techniques-malware/
Russian Cyber Attacks Against NATO States Rise by 25%
An analysis has found a 25% year-on-year increase in Russian cyber activity targeting NATO countries. The surge includes espionage, disruption campaigns, and attacks on smaller firms seen as entry points to larger organisations. The findings suggest that Russian state actors are expanding their operations beyond Ukraine, using cybercriminal infrastructure to mask attribution and increase reach.
US Authorities Seize $15 Billion in Bitcoin from Crypto Scam Network
Law enforcement agencies in the US have seized around $15 billion in Bitcoin linked to the Prince Group, a criminal organisation accused of running a vast crypto fraud and human trafficking operation. The group allegedly laundered funds via gambling/crypto-mining businesses and complex crypto transfers from forced labour and fake investment schemes. The investigation, led by the Department of Justice, uncovered a global network of illicit financial activity. This is one of the largest crypto-related seizures to date and underscores the growing use of digital assets in organised crime.
Source: https://www.helpnetsecurity.com/2025/10/15/prince-group-crypto-scam-15-billion-in-bitcoin-seized/
Governance, Risk and Compliance
Warning to UK following spike in online attacks | The Independent
China and Russia posing ‘significant threat’ to UK in cyberspace, NCSC warns | The Standard
China poses 'highly sophisticated' cyber threat to UK, NCSC warns | UK News | Sky News
Ministers urge businesses to take cyber-attacks seriously - UKTN
Cyber-attacks rise by 50% in past year, UK security agency says | Cybercrime | The Guardian
UK security services step up work with business to fight cyber threats
Company bosses warned cyber attacks are 'not a question of if but when' | ITV News
UK Cyber Incidents Rise for Third Straight Year
Have plans on paper in case of cyber-attack, firms told - BBC News
Senior Execs Falling Short on Cyber-Attack Preparedness, NCSC Warns - Infosecurity Magazine
Move to hybrid working creates cyber risks – study
CISOs must rethink the tabletop, as 57% of incidents have never been rehearsed | CSO Online
Government urges businesses to keep paper back-ups for cyber-attack recovery | AccountingWEB
Threats
Ransomware, Extortion and Destructive Attacks
Q3 ransomware attacks up 36 percent year-on-year - BetaNews
Salesforce bandits run into hiding amid arrests, seizures • The Register
Extortion and ransomware drive over half of cyberattacks - Microsoft On the Issues
LockBit, Qilin, DragonForce form ransomware cartel | Cybernews
Third time lucky? The FBI just took down BreachForums, again | IT Pro
Scattered Lapsus$ Hunters extortion site goes dark: What’s next? | CSO Online
Qilin Ransomware announced new victims
Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign
Microsoft disrupts ransomware attacks targeting Teams users
Ransomware Victims
Co-op CEO: ‘The buck for cyber stops with us as senior leaders’ – PublicTechnology
Extortion Group Leaks Millions of Records From Salesforce Hacks - SecurityWeek
Third time lucky? The FBI just took down BreachForums, again | IT Pro
Russian hackers target software used by Treasury and NHS
Russia may have been behind Jaguar Land Rover cyber attack
Qilin Ransomware announced new victims
Qantas says customer data released by cyber criminals months after cyber breach | Reuters
Clop Ransomware group claims the hack of Harvard University
Phishing & Email Based Attacks
ClickFix attacks are surging, and Microsoft says you are the only defense | ZDNET
Phishing kit YYlaiyu impersonates 97 brands for fraud • The Register
Fresh Phishing Kit Innovation: Automated ClickFix Attacks
Microsoft remains the most imitated brand in phishing scams - BetaNews
KnowBe4 warns of new PayPal invoice phishing scam - IT Security Guru
Cyberattackers Target LastPass, Top Password Managers
LastPass Warns Customers It Has Not Been Hacked Amid Phishing Emails - Infosecurity Magazine
Other Social Engineering
ClickFix attacks are surging, and Microsoft says you are the only defense | ZDNET
Victims of romance fraud tricked out of £106m last year - BBC News
Fraud, Scams and Financial Crime
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Scam texts net over $1 billion for cyber gangs - how to avoid their traps | ZDNET
Phishing kit YYlaiyu impersonates 97 brands for fraud • The Register
The UK Dealer With Prosthetic Hands Brought Down by the World’s Biggest Dark Web Bust
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites
UK telcos step up efforts to combat ‘epidemic’ of handset fraud
Artificial Intelligence
Rise in ‘Shadow AI’ tools raising security concerns for UK
Microsoft warns of the dangers of Shadow AI • The Register
Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors
Your browser is an AI-enabled OS, so secure it like one | TechTarget
Researchers Warn of Security Gaps in AI Browsers - Infosecurity Magazine
Everyone wants AI, but few are ready to defend it - Help Net Security
UK Firms Lose Average of £2.9m to AI Risk - Infosecurity Magazine
AI Attacks Surge as Microsoft Process 100 Trillion Signals Daily - Infosecurity Magazine
Security risks of vibe coding and LLM assistants for developers
Teenager allegedly incriminates himself via conversation with AI chat bot | The Independent
CISOs brace for an “AI vs. AI” fight | CSO Online
2FA/MFA
Hackers can steal 2FA codes and private messages from Android phones - Ars Technica
New 'Pixnapping' attack lets hackers steal Android chats, 2FA codes in seconds | Mashable
Malware
New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns
New Stealit Malware Campaign Spreads via VPN and Game Installer Apps - Infosecurity Magazine
Massive multi-country botnet targets RDP services in the US
What a new mega-worm says about open source cybersecurity - Tech Monitor
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
Nation-state hackers deliver malware from “bulletproof” blockchains - Ars Technica
China's Flax Typhoon Turns Geo-Mapping into Backdoor
Bots/Botnets
New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs
Massive multi-country botnet targets RDP services in the US
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands
Mobile
Hackers can steal 2FA codes and private messages from Android phones - Ars Technica
New 'Pixnapping' attack lets hackers steal Android chats, 2FA codes in seconds | Mashable
Popular VPN app can empty bank accounts, security experts warn | The Independent
You Only Need $750 of Equipment to Pilfer Data From Satellites, Researchers Say
Researchers find a startlingly cheap way to steal your secrets from space | CyberScoop
Denial of Service/DoS/DDoS
Man Launches "World's First Waymo DDoS" by Ordering 50 Robotaxis to Dead End Street
Internet of Things – IoT
RondoDox Botnet targets 56 flaws across 30+ device types worldwide
Man Launches "World's First Waymo DDoS" by Ordering 50 Robotaxis to Dead End Street
Humanoid robot found vulnerable to Bluetooth hack, data leaks to China - Help Net Security
Data Breaches/Leaks
US Warns of ‘Catastrophic’ Hacks After Cyber Firm F5 Breach - Bloomberg
China Accessed Classified UK Systems for a Decade, Officials Say - Bloomberg
Third time lucky? The FBI just took down BreachForums, again | IT Pro
Attackers exploit valid logins in SonicWall SSL VPN compromise
Prospect union tells members their data was breached in June • The Register
Capita fined £14M after 58-hour delay exposed 6.6M records • The Register
The company Discord blamed for its recent breach says it wasn't hacked
Over 23 Million Victims Hit by Data Breaches in Q3 - Infosecurity Magazine
How Cybercriminal Organizations Weaponize Exposed Secrets - Security Boulevard
Spanish fashion retailer MANGO disclosed a data breach
Auction giant Sotheby’s says data breach exposed financial information
Cabinet Office rejects Cummings' claim that China breached high-level systems - BBC News
8 Auto Insurance Providers to Pay New York $19M Over Data Breaches
They were victims of a massive data breach in 2009. Their employer denied it for a decade | CBC News
Have I Been Pwned: Prosper data breach impacts 17.6 million accounts
Organised Crime & Criminal Actors
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Scam texts net over $1 billion for cyber gangs - how to avoid their traps | ZDNET
The UK Dealer With Prosthetic Hands Brought Down by the World’s Biggest Dark Web Bust
UK and US impose sanctions on alleged Cambodian ‘cyber-scam’ network
Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained
PowerSchool hacker sentenced to 4 years in prison | CyberScoop
Attackers don’t linger, they strike and move on - Help Net Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Scam texts net over $1 billion for cyber gangs - how to avoid their traps | ZDNET
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites
Insurance
Ransomware costs soar as cyber claims decline - Insurance Post
How Ransomware’s Data Theft Evolution is Rewriting Cyber Insurance Risk Models - Security Boulevard
Supply Chain and Third Parties
Capita fined £14M after 58-hour delay exposed 6.6M records • The Register
Russian hackers target software used by Treasury and NHS
Russia may have been behind Jaguar Land Rover cyber attack
Supply Chain Risks Lurking in VS Code Marketplaces
The company Discord blamed for its recent breach says it wasn't hacked
Why vendor risk management can’t be an afterthought
Software Supply Chain
Supply Chain Risks Lurking in VS Code Marketplaces
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns
Cloud/SaaS
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
Fresh Phishing Kit Innovation: Automated ClickFix Attacks
Microsoft investigates outage affecting Microsoft 365 apps
Microsoft Revokes 200 Fraudulent Certificates Used in Rhysida Ransomware Campaign
Microsoft disrupts ransomware attacks targeting Teams users
Outages
Microsoft investigates outage affecting Microsoft 365 apps
Identity and Access Management
The password problem we keep pretending to fix - Help Net Security
Linux and Open Source
LinkPro Linux Rootkit Uses eBPF to Hide and Activates via Magic TCP Packets
What a new mega-worm says about open source cybersecurity - Tech Monitor
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
New Rootkit Campaign Exploits Cisco SNMP Flaw to Gain Persistence - Infosecurity Magazine
German state replaces Microsoft Exchange and Outlook with open-source email | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
SonicWall VPN accounts breached using stolen creds in widespread attacks
The password problem we keep pretending to fix - Help Net Security
New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands
Cyberattackers Target LastPass, Top Password Managers
LastPass Warns Customers It Has Not Been Hacked Amid Phishing Emails - Infosecurity Magazine
Legacy Windows Protocols Still Expose Networks to Credential Theft - Infosecurity Magazine
Social Media
How to secure corporate social media accounts before they become a breach vector | SC Media
Regulations, Fines and Legislation
Capita fined £14M after 58-hour delay exposed 6.6M records • The Register
Banks failing to curb rise in romance fraud, says UK watchdog
Victims of romance fraud tricked out of £106m last year - BBC News
Ofcom fines 4chan £20K for Online Safety Act failings • The Register
Cyber Resilience Act: The Clock is Ticking for Compliance | White & Case LLP - JDSupra
Cisco faces Senate scrutiny over firewall flaws • The Register
8 Auto Insurance Providers to Pay New York $19M Over Data Breaches
The Things that Bedevil U.S. Cyber Power
The End of Cybersecurity | Foreign Affairs
Models, Frameworks and Standards
Cyber Resilience Act: The Clock is Ticking for Compliance | White & Case LLP - JDSupra
Law Enforcement Action and Take Downs
U.S. seizes $15 billion in Bitcoin linked to massive forced-labor crypto scam - Help Net Security
UK, US Sanction Southeast Asia-Based Online Scam Network - Infosecurity Magazine
Operation Heracles strikes blow against massive network of fraudulent crypto trading sites
The UK Dealer With Prosthetic Hands Brought Down by the World’s Biggest Dark Web Bust
Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained
PowerSchool hacker sentenced to 4 years in prison | CyberScoop
Third time lucky? The FBI just took down BreachForums, again | IT Pro
BreachForums seized, but hackers say they will still leak Salesforce data
Teenager allegedly incriminates himself via conversation with AI chat bot | The Independent
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Russian cyber-attacks against Nato states up by 25% in a year, analysis finds | Nato | The Guardian
Nation State Actors
Ministers urge businesses to take cyber-attacks seriously - UKTN
Ministerial letter on cyber security to leading UK companies - GOV.UK
NCSC demands action amid 50% surge in major UK cyberattacks • The Register
UK security services step up work with business to fight cyber threats
US Warns of ‘Catastrophic’ Hacks After Cyber Firm F5 Breach - Bloomberg
F5 Says Nation-State Hackers Stole Source Code and Vulnerability Data - SecurityWeek
Thousands of customers imperiled after nation-state ransacks F5’s network - Ars Technica
Nation-state hackers deliver malware from “bulletproof” blockchains - Ars Technica
China
China and Russia posing ‘significant threat’ to UK cyberspace, experts warn | The Independent
China poses 'highly sophisticated' cyber threat to UK, NCSC warns | UK News | Sky News
Cyber-attacks rise by 50% in past year, UK security agency says | Cybercrime | The Guardian
Chinese Hackers Exploit ArcGIS Server as Backdoor for Over a Year
Netherlands seizes Chinese-owned microchip maker to protect national security
China Accessed Classified UK Systems for a Decade, Officials Say - Bloomberg
Cabinet Office rejects Cummings' claim that China breached high-level systems - BBC News
China's Flax Typhoon Turns Geo-Mapping into Backdoor
The controversy over the collapsed China spy case explained - BBC News
Badenoch demands PM address 'unanswered' China spy case questions - BBC News
Taiwan faces 2.8 million Chinese cyberattacks a day | Taiwan News | Oct. 14, 2025 10:05
Humanoid robot found vulnerable to Bluetooth hack, data leaks to China - Help Net Security
Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months
Phishing kit YYlaiyu impersonates 97 brands for fraud • The Register
Russia
China and Russia posing ‘significant threat’ to UK cyberspace, experts warn | The Independent
China poses 'highly sophisticated' cyber threat to UK, NCSC warns | UK News | Sky News
Cyber-attacks rise by 50% in past year, UK security agency says | Cybercrime | The Guardian
Russian cyber-attacks against Nato states up by 25% in a year, analysis finds | Nato | The Guardian
Russian hackers target software used by Treasury and NHS
Russia may have been behind Jaguar Land Rover cyber attack
Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors
Chinese cyberspies compromised Russian tech provider • The Register
Hacktivists deactivate after falling into researchers' trap • The Register
Iran
Iran is not initiating cyberattacks against any country - Mehr News Agency
North Korea
Tools and Controls
Your browser is an AI-enabled OS, so secure it like one | TechTarget
CISOs must rethink the tabletop, as 57% of incidents have never been rehearsed | CSO Online
The password problem we keep pretending to fix - Help Net Security
Why vendor risk management can’t be an afterthought
Massive multi-country botnet targets RDP services in the US
Researchers Warn of Security Gaps in AI Browsers - Infosecurity Magazine
Everyone’s adopting AI, few are managing the risk - Help Net Security
Hackers Turn Velociraptor DFIR Tool Into Weapon in LockBit Ransomware Attacks
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign - SecurityWeek
Inside the CISO Mind: How Security Leaders Choose Solutions - Security Boulevard
Legacy Windows Protocols Still Expose Networks to Credential Theft - Infosecurity Magazine
Popular VPN app can empty bank accounts, security experts warn | The Independent
Security risks of vibe coding and LLM assistants for developers
How Ransomware’s Data Theft Evolution is Rewriting Cyber Insurance Risk Models - Security Boulevard
3 firmware security failures that show how little motherboard manufacturers care
Other News
Satellites Are Leaking the World’s Secrets: Calls, Texts, Military and Corporate Data | WIRED
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign - SecurityWeek
Critical infrastructure CISOs Can't Ignore Office Data
Why the web-hosting industry needs a trust seal | CyberScoop
Dull but dangerous: A guide to 15 overlooked cybersecurity blind spots | CSO Online
The power grid is getting old, and so is the cybersecurity protecting it - Help Net Security
EU's biometric border system suffers teething problems • The Register
Leak From the Sky: It Turns Out a Lot of Satellite Data Is Unencrypted | PCMag
Legacy Windows Protocols Still Expose Networks to Credential Theft - Infosecurity Magazine
The solar power boom opened a backdoor for cybercriminals - Help Net Security
Focus on cyber security essential, says Taoiseach
How This Overlooked Risk Can Collapse Your Startup Overnight
Vulnerability Management
Final Windows 10 Patch Tuesday update rolls out as support ends
Windows 10 Still on Over 40% of Devices as It Reaches End of Support - SecurityWeek
Microsoft: Exchange 2016 and 2019 have reached end of support
CVE, CVSS scores need overhauling, argues Codific CEO • The Register
Security firms dispute credit for overlapping CVE reports
Vulnerabilities
F5 releases BIG-IP patches for stolen security vulnerabilities
Cisco faces Senate scrutiny over firewall flaws • The Register
Attackers exploit valid logins in SonicWall SSL VPN compromise
Experts Warn of Widespread SonicWall VPN Compromise Impacting Over 100 Accounts
New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login
Microsoft frightful Patch Tuesday: 175+ CVEs, 3 under attack • The Register
Critical Veeam Backup RCE Vulnerabilities Let Attackers Execute Malicious Code Remotely
Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign - SecurityWeek
Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in 'Zero Disco' Attacks
ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities - SecurityWeek
High-Severity Vulnerabilities Patched by Fortinet and Ivanti - SecurityWeek
Adobe Patches Critical Vulnerability in Connect Collaboration Suite - SecurityWeek
CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack
Microsoft patches ASP.NET Core bug rated highly critical • The Register
Juniper patched nine critical flaws in Junos Space
SAP Patches Critical Vulnerabilities in NetWeaver, Print Service, SRM - SecurityWeek
Gladinet Patches Exploited CentreStack Vulnerability - SecurityWeek
Final Windows 10 Patch Tuesday update rolls out as support ends
Windows 10 Still on Over 40% of Devices as It Reaches End of Support - SecurityWeek
Oracle rushes out another emergency E-Business Suite patch • The Register
Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Advisory 16 October 2025 - Security Updates from Microsoft, SAP, Fortinet, Ivanti and Oracle (E-Business Suite)
Black Arrow Cyber Advisory 16 October 2025 - Security Updates from Microsoft, SAP, Fortinet, Ivanti and Oracle (E-Business Suite)
Executive Summary
This month’s updates span Microsoft’s regular Patch Tuesday release, SAP’s Security Patch Day, large batches from Fortinet across network and endpoint products, targeted fixes from Ivanti for enterprise mobility/secure access, and a standalone Oracle Security Alert for E-Business Suite issued on 11 October. Prioritise actively exploited Windows issues (where present), SAP high and critical security notes, Fortinet gateway/endpoint components, Ivanti EPM/EPMM/Neurons platforms, and Oracle E-Business Suite where exposure is internet-facing.
Vulnerabilities by Vendor
Microsoft: 173 vulnerabilities including five critical-severity security defects and two flaws that have been exploited in the wild.Vulnerabilies affecting Windows (client/server), Office/SharePoint, .NET/Visual Studio, Azure services, and Microsoft Edge (Chromium). Prioritise patches addressing any actively exploited items and Critical RCE/EoP paths in Windows and server components.
SAP: 16 new and updated patches as part of its monthly rollout, across on-prem and cloud product families (e.g., NetWeaver, S/4HANA, Business Objects). Prioritise High/Critical security notes and authentication/authorisation weaknesses.
Fortinet: 29 advisories across FortiOS/FortiProxy, FortiDLP, FortiClient, FortiIsolator, FortiPAM, FortiManager/Analyzer, FortiADC/FortiWeb and others. Prioritise High/Critical items on perimeter firewalls, proxies and endpoint agents; review PSIRT entries for products you operate.
Ivanti: Several updates across Endpoint Manager (EPM), End Point Manager Mobile (EPMM) and Neurons. Prioritise High/Critical updates for EPM and EPMM; apply latest EPM/EPMM and Neurons updates if not yet deployed.
Oracle (E-Business Suite only): 1 vulnerability (Security Alert CVE-2025-61884, released 11 October 2025), affecting E-Business Suite 12.2.3–12.2.14. Vulnerability is remotely exploitable without authentication; prioritise immediate patching on any externally accessible instances.
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
Sources:
1 Microsoft — https://msrc.microsoft.com/update-guide
2 SAP — https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2025.html
3 Fortinet — https://www.fortiguard.com/psirt
4 Ivanti — https://www.ivanti.com/blog/october-2025-security-update
5 Oracle — (E-Business Suite Security Alert CVE-2025-61884) — https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
Black Arrow Cyber Threat Intelligence Briefing 10 October 2025
Black Arrow Cyber Threat Intelligence Briefing 10 October 2025:
-CFOs Put Cyber at the Top of the Risk Agenda
-SonicWall Cloud Backup Breach Exposes Firewall Configurations
-Budgets and Skills Lag Behind Rising Attacks
-SMBs Remain Exposed to AI‑Driven Threats and Ransomware Complacency
-Digital Fraud Now Costs Firms an Average 7.7% of Revenue
-Survey Finds Attacks Hit 91% of UK Universities and 43% of Businesses
-Insurer Forecasts 40% Rise in Named Ransomware Victims by 2026
-Paying Ransoms Increasingly Fails to Restore Data
-SaaS Incidents Surge Despite High Confidence
-AI Supercharges Phishing and Stretches Defences
-Deepfake Voice Risks Highlight Identity Verification Gaps
-Insurers and Asset Managers Expand Cybersecurity Oversight
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
Our review of business and cyber security media this week highlights that cyber risk is escalating across finance, education and supply chains, with attacks growing in scale and sophistication. AI-driven threats and deepfake-enabled fraud are eroding traditional defences, while SaaS misconfigurations and legacy systems widen exposure.
Surveys reveal persistent gaps in budgets, skills and governance, leaving many organisations underprepared. Ransomware recovery rates are falling, and digital fraud now consumes a significant share of revenue.
Boards are under pressure to strengthen oversight and link leadership incentives to cyber performance, yet complacency remains a critical risk. In our work with business leaders across countries and sectors, we see the value of leaders taking command by understanding their risks and governing their resilience across people, operations and controls. Contact us to discuss how we can support your leadership through focused upskilling and governance support.
Top Cyber Stories of the Last Week
CFOs Put Cyber at the Top of the Risk Agenda
New research of UK finance leaders finds 99% experienced payments‑related cyber incidents in the past two years and 94% plan to raise cyber spend, with over half preparing a significant uplift. Accounts Payable automation is the top priority, yet 47% cite integration with existing systems as the main barrier and only 64% feel confident they have real‑time oversight. The findings underline the exposure created by legacy platforms and fragmented processes and the need for tighter controls, better visibility and stronger governance across finance operations.
SonicWall Cloud Backup Breach Exposes Firewall Configurations
SonicWall confirmed that an attacker accessed firewall configuration backup files for all customers who used its cloud backup service. While credentials in the files are encrypted, possession of configurations raises the risk of targeted exploitation. SonicWall, working with Mandiant, issued remediation guidance including comprehensive credential resets and prioritisation of internet‑facing devices.
Source: https://cyberscoop.com/sonicwall-customer-firewall-configurations-exposed/
Budgets and Skills Lag Behind Rising Attacks
ISACA’s latest survey reports 39% of European organisations are facing more attacks than a year ago, while only 38% are completely confident in detection and response. Despite incremental improvements, 58% remain understaffed and 54% say budgets are still insufficient. Stress and burnout persist, with 68% saying the job is more stressful than five years ago and 22% of organisations taking no action to address it. The data points to structural capability gaps that leadership must close to improve resilience.
SMBs Remain Exposed to AI‑Driven Threats and Ransomware Complacency
A new report highlights how AI is supercharging social engineering and malware while a complacency gap persists in smaller firms. Automated, highly personalised campaigns are raising the success rate of phishing and voice scams, and the financial fallout now stretches far beyond the ransom to business‑ending costs. The analysis argues that many SMBs still underestimate their exposure and need proactive, specialised security and clearer accountability for risk.
Digital Fraud Now Costs Firms an Average 7.7% of Revenue
TransUnion’s H2 2025 update estimates global businesses lost $534bn over the past year to digital fraud, with US firms averaging 9.8% of revenue. Account takeover has surged and is now the top driver of losses in the US at 31%, with smishing, phishing and vishing widespread. The findings reinforce the need for stronger identity assurance, layered controls and active monitoring of customer interactions across channels.
Source: https://www.infosecurity-magazine.com/news/digital-fraud-costs-companies/
Survey Finds Attacks Hit 91% of UK Universities and 43% of Businesses
A recent UK survey reveals that 91% of universities and 43% of businesses experienced cyberattacks in the past year, affecting over 600,000 businesses and 61,000 charities. The findings highlight widespread vulnerabilities across sectors, with education institutions particularly exposed due to legacy systems and limited cyber budgets. Despite the scale of attacks, many organisations remain underprepared, lacking robust incident response plans and adequate cyber insurance. Experts warn that complacency and outdated security practices are leaving critical data and operations at risk, urging leadership to prioritise cyber resilience and invest in modern defences.
Insurer Forecasts 40% Rise in Named Ransomware Victims by 2026
QBE warns leak‑site victims could exceed 7,000 by 2026, a 40% jump on 2024, with criminals exploiting cloud platforms and AI. Between 2023 and 2025 the UK accounted for 10% of significant incidents. Deepfakes featured in nearly 10% of cases in 2024 with wide‑ranging losses. The report stresses supply chain dependencies and the need for stronger oversight of third parties and recovery planning.
Paying Ransoms Increasingly Fails to Restore Data
A Veeam study finds only 32% of organisations that paid ransoms in 2024 recovered their data, down from 54% in 2023. 63% lack alternative infrastructure for site‑wide recovery. The report highlights data theft‑only tactics and the case for tested backups, segmented recovery and rehearsed decision‑making.
SaaS Incidents Surge Despite High Confidence
AppOmni’s 2025 study shows 75% of organisations suffered a SaaS incident in the past year while 91% felt confident in their posture. Incidents are often driven by permissions issues and misconfigurations, and accountability is fragmented across business units. The report calls for continuous oversight and independent validation of SaaS controls.
AI Supercharges Phishing and Stretches Defences
A Comcast report analysed 34.6 billion events, showing attackers scale noisy campaigns while running quiet intrusions in parallel. Generative AI makes it easier to craft realistic phishing attempts and malware, while shadow AI and non‑human identities widen exposure. Human fatigue and proxy abuse further erode traditional detection methods, strengthening the case for layered, behaviour‑based controls.
Source: https://www.helpnetsecurity.com/2025/10/06/phishing-ai-enterprise-resilience-security/
Deepfake Voice Risks Highlight Identity Verification Gaps
Microsoft halted its Speak for Me voice cloning test after concerns it could enable fraud through highly convincing impersonations. This highlights the dangers of implementing voice cloning without strong security and verification controls.
Source: https://www.darkreading.com/application-security/microsoft-voice-clone-scary-unsalvageable
Insurers and Asset Managers Expand Cybersecurity Oversight
Moody’s survey of 102 insurers and asset managers shows cyber security remains a top board-level priority. Budgets are rising, firms plan to hire specialists, and advanced defence strategies are being adopted. Oversight is strengthening, with 40% now linking CEO pay to cyber performance goals, up from 24% in 2023. Regional gaps persist in third-party risk management, AI governance, and cyber insurance coverage. Most respondents maintain vendor risk programmes, and over 80% have AI policies. Cyber insurance adoption is highest in the Americas, and 21% plan to increase coverage limits in 2025.
Governance, Risk and Compliance
Cybersecurity Tops CFO’s Risk Agenda With 99% Reporting Incidents and 94% Planning to Increase Spend
The cost of cyber hacking on UK business is greater than it seems - BBC News
Overconfidence major cyber risk for business – report
Six metrics policymakers need to track cyber resilience - Help Net Security
The Evolving Role of the CSO: From Technical Guardian to Business Strategist - Security Boulevard
NCSC: Observability and Threat Hunting Must Improve - Infosecurity Magazine
Cyber Risks Can Be Legal Risks: How to Protect the Organization | Security Magazine
Threats
Ransomware, Extortion and Destructive Attacks
Many businesses paying a ransomware demand don't get their data back | TechRadar
Ransomware Group “Trinity of Chaos” Launches Data Leak Site - Infosecurity Magazine
Ransomware attacks to surge 40% by 2026 amid AI and cloud vulnerabilities: QBE - Reinsurance News
29% of businesses that paid cyber attack ransoms still had their data leaked
Active Ransomware Groups Reach an All-Time High, GuidePoint Security Finds
SMBs vulnerable to AI-powered cyberattacks and complacent about ransomware - BetaNews
Hackers launch data leak site to extort 39 victims, or Salesforce - Help Net Security
Salesloft hackers outsourcing ransom negotiations for $10 • The Register
LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem
Ransomware Attacks Skyrocket, Forcing Companies to Confront a Vexing Question | Law.com
Cybersecurity Needs A Supply Chain Perspective: JLR attack Shows Why
Google says 'likely over 100' affected by Oracle-linked hacking campaign | Reuters
Oracle links Clop extortion attacks to July 2025 vulnerabilities
Oracle tells Clop-targeted EBS users to apply July patch • The Register
Microsoft: Critical GoAnywhere bug exploited in ransomware attacks
Red Hat data breach escalates as ShinyHunters joins extortion
Salesforce refuses to pay ransom over widespread data theft attacks
Inside the 'Trinity of Chaos' group of young hackers targeting major companies - ABC News
Ransomware Gangs Leverage Remote Access Tools to Gain Persistence and Evade Defenses
XWorm malware resurfaces with ransomware module, over 35 plugins
Teens arrested in London preschool ransomware attack • The Register
Chaos Ransomware Upgrades With Aggressive New Variant
Hackers now use Velociraptor DFIR tool in ransomware attacks
Ransomware Victims
Hackers hold 1 billion customer records to ransom | The Independent
The cost of cyber hacking on UK business is greater than it seems - BBC News
Salesforce refuses to pay ransomware crims' extortion demand • The Register
Jaguar Land Rover Shows Cyberattacks Mean Business
Japan’s Asahi ships beer manually after ransomware attack | The Straits Times
Jaguar Land Rover expected to restart some production after cyber-attack - BBC News
Aston Martin warns of disruption in wake of JLR cyber attack
JLR counts cost of cyber hack with UK retail sales down 32% | Manufacturer News
Co-op set to reveal financial toll caused by cyberattack | The Independent
Teens arrested in London preschool ransomware attack • The Register
Phishing & Email Based Attacks
SpamGPT - When Phishing Gets a Marketing Degree - Security Boulevard
Phishing Is Only the Tip of Cybersecurity’s AI Arms Race | MSSP Alert
Phishing is old, but AI just gave it new life - Help Net Security
New ‘point-and-click’ phishing kit simplifies malicious attachment creation | SC Media
How Phishing Kits Are Evading Detection & Ways to Beat Them | MSSP Alert
APT Hackers Exploit ChatGPT to Create Sophisticated Malware and Phishing Emails
From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine
Why Brand Impersonation Is A Marketing Crisis, Not Just A Cybersecurity Problem
Hackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks
Other Social Engineering
North Korean hackers stealing record sums, researchers say - BBC News
New FileFix attack uses cache smuggling to evade security software
Microsoft Warns of Hackers Abuse Teams Features and Capabilities to Deliver Malware
BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers
Fraud, Scams and Financial Crime
Digital Fraud Costs Companies Worldwide 7.7% of Annual Revenue - Infosecurity Magazine
Brazilian scammers, raking in millions, used Gisele Bundchen deepfakes on Instagram ads | Reuters
Former Tory council leader on trial over alleged romance fraud - BBC News
Artificial Intelligence
SMBs vulnerable to AI-powered cyberattacks and complacent about ransomware - BetaNews
SpamGPT - When Phishing Gets a Marketing Degree - Security Boulevard
Phishing Is Only the Tip of Cybersecurity’s AI Arms Race | MSSP Alert
Phishing is old, but AI just gave it new life - Help Net Security
APT Hackers Exploit ChatGPT to Create Sophisticated Malware and Phishing Emails
Ransomware attacks to surge 40% by 2026 amid AI and cloud vulnerabilities: QBE - Reinsurance News
Microsoft's Voice Clone Becomes Scary & Unsalvageable
FraudGPT and WormGPT, are now available on dark net forums for as low as $100 - The420.in
AI is making cybercriminal workflows more efficient too, OpenAI finds | ZDNET
Two-thirds of bank staff using unapproved AI tools - survey
From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine
Cybersecurity’s next test: AI, quantum, and geopolitics - Help Net Security
Employees regularly paste company secrets into ChatGPT • The Register
How Your AI Chatbot Can Become a Backdoor | Trend Micro (US)
OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks
What CISOs should know about DeepSeek cybersecurity risks | TechTarget
Brazilian scammers, raking in millions, used Gisele Bundchen deepfakes on Instagram ads | Reuters
Take Note: Cyber-Risks With AI Notetakers
CometJacking: One Click Can Turn Perplexity's Comet AI Browser Into a Data Thief
ICO’s £7.5m Clearview AI Fine a Step Closer After Legal Victory - Infosecurity Magazine
Malware
APT Hackers Exploit ChatGPT to Create Sophisticated Malware and Phishing Emails
Sophisticated Malware Deployed in Oracle EBS Zero-Day Attacks - SecurityWeek
From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine
New FileFix attack uses cache smuggling to evade security software
Microsoft Warns of Hackers Abuse Teams Features and Capabilities to Deliver Malware
Hackers Exploit RMM Tools to Deploy Malware - InfoRiskToday
From infostealer to full RAT: dissecting the PureRAT attack chain
BatShadow Group Uses New Go-Based 'Vampire Bot' Malware to Hunt Job Seekers
XWorm malware resurfaces with ransomware module, over 35 plugins
Detour Dog Caught Running DNS-Powered Malware Factory for Strela Stealer
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
Self-Propagating Malware Hits WhatsApp Users in Brazil
Bots/Botnets
RondoDox botnet fires 'exploit shotgun' at edge devices • The Register
The architecture of lies: Bot farms are running the disinformation war - Help Net Security
Mobile
Google Pixel October security patch continues to fix haunting display problems | Android Central
New ClayRat Spyware Targets Android Users via Fake WhatsApp and TikTok Apps
Self-Propagating Malware Hits WhatsApp Users in Brazil
Denial of Service/DoS/DDoS
Telco biz ICUK restores services after two-day DDoS pelting • The Register
Internet of Things – IoT
Connected devices in the workplace: innovation or a gateway for cyberattacks?
Building owners face up to growing cyber threat
How to protect your car from hacking | Kaspersky official blog
Data Breaches/Leaks
Red Hat Breach Exposes 5000+ High Profile Enterprise Customers at Risk
Google says 'likely over 100' affected by Oracle-linked hacking campaign | Reuters
CL0P-Linked Hackers Breach Dozens of Organizations Through Oracle Software Flaw
Discord discloses data breach after hackers steal support tickets
Hackers claim Discord breach exposed data of 5.5 million users
Renault warns UK customers after cyberattack exposes data
Military radio maker BK Technologies cops to cyber break-in • The Register
Electronics giant Avnet confirms breach, says stolen data unreadable
Dutch travel company refuses compensation after cyberattack exposes customer data | NL Times
Data Breach at Doctors Imaging Group Impacts 171,000 People - SecurityWeek
Sunweb confirms data breach, warns customers to be on their guard | TechRadar
DraftKings warns of account breaches in credential stuffing attacks
Boyd Gaming sued by employee over data breach | Cybernews
Organised Crime & Criminal Actors
Europol Calls for Stronger Data Laws to Combat Cybercrime - Infosecurity Magazine
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
North Korean hackers stole $2 billion in crypto this year: report - UPI.com
Kremlin-backed crypto coin moves $6bn despite US sanctions
Politics Home Article | UK Faces Diplomatic Battle Over £5.5bn Bitcoin Claim
Insider Risk and Insider Threats
Employees regularly paste company secrets into ChatGPT • The Register
Insurance
Cyber cover concerns remain for risk managers – FERMA
Cyber insurance should complement, not replace, cybersecurity: FERMA - Reinsurance News
Impacts of Cyber Threat Landscape on Insurers and Policyholders | Gray Reed - JDSupra
Why cyber-security insurance matters for charities | Third Sector
Supply Chain and Third Parties
Cybersecurity Needs A Supply Chain Perspective: JLR attack Shows Why
The cost of cyber hacking on UK business is greater than it seems - BBC News
Cyber-Attack Contributes to Huge Sales Drop at JLR - Infosecurity Magazine
Cloud/SaaS
Ransomware attacks to surge 40% by 2026 amid AI and cloud vulnerabilities: QBE - Reinsurance News
Hackers claim Discord breach exposed data of 5.5 million users
Discord Says 70,000 Users Had IDs Exposed in Recent Data Breach - SecurityWeek
Microsoft Warns of Hackers Abuse Teams Features and Capabilities to Deliver Malware
Microsoft 365 outage blocks access to Teams, Exchange Online
Outages
Microsoft 365 outage blocks access to Teams, Exchange Online
Azure outage blocks access to Microsoft 365 services, admin portals
Encryption
Cybersecurity’s next test: AI, quantum, and geopolitics - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
GreyNoise detects 500% surge in scans targeting Palo Alto Networks portals
Massive surge in scans targeting Palo Alto Networks login portals
DraftKings warns of account breaches in credential stuffing attacks
Social Media
Brazilian scammers, raking in millions, used Gisele Bundchen deepfakes on Instagram ads | Reuters
LinkedIn sues ProAPIs for using 1M fake accounts to scrape user data
Malvertising
Brazilian scammers, raking in millions, used Gisele Bundchen deepfakes on Instagram ads | Reuters
Regulations, Fines and Legislation
Europol Calls for Stronger Data Laws to Combat Cybercrime - Infosecurity Magazine
Invite us to your cyber war games, Finra urges members - Risk.net
German government says it will oppose EU mass-scanning proposal | CyberScoop
ICO’s £7.5m Clearview AI Fine a Step Closer After Legal Victory - Infosecurity Magazine
Federal judiciary touts cybersecurity work in wake of latest major breach | CyberScoop
State Cyber Teams Brace for Impact of US Government Shutdown
Federal shutdown deals blow to already hobbled cybersecurity agency
UK government says digital ID won't be compulsory – honest • The Register
Careers, Working in Cyber and Information Security
How to succeed at cybersecurity job interviews - Help Net Security
Law Enforcement Action and Take Downs
Teens arrested in London preschool ransomware attack • The Register
Arrests Underscore Fears of Teen Cyberespionage Recruitment
Politics Home Article | UK Faces Diplomatic Battle Over £5.5bn Bitcoin Claim
Former Tory council leader on trial over alleged romance fraud - BBC News
Misinformation, Disinformation and Propaganda
The architecture of lies: Bot farms are running the disinformation war - Help Net Security
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
China Is Joining Russia’s Shadow War on Europe - Bloomberg
Russia: already at war with Europe? | The Week
"We are already in the middle of a cyber war” - NATO expert warns - 08.10.2025 | BURSA.RO
Russia waging ‘grey-zone campaign’ and Europe must meet challenge, says EU chief
Nation State Actors
Cybersecurity’s next test: AI, quantum, and geopolitics - Help Net Security
China
China Is Joining Russia’s Shadow War on Europe - Bloomberg
Security Firm Exposes Role of Beijing Research Institute in China's Cyber Operations - SecurityWeek
OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks
China-linked hacking fears over Cisco devices in offices
PRC Gov't Fronts Trick the West to Obtain Cyber Tech
What CISOs should know about DeepSeek cybersecurity risks | TechTarget
Law firm representing big-name politicians hit with major hack from China: report - Raw Story
Chinese Cybercrime Group Runs Global SEO Fraud Ring Using Compromised IIS Servers
Most telcos have been hit by Salt Typhoon-style attacks
No 10 denies government involved in collapse of China spying case - BBC News
Russia
Russia: already at war with Europe? | The Week
"We are already in the middle of a cyber war” - NATO expert warns - 08.10.2025 | BURSA.RO
OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks
Russia waging ‘grey-zone campaign’ and Europe must meet challenge, says EU chief
From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine
China Is Joining Russia’s Shadow War on Europe - Bloomberg
Arrests Underscore Fears of Teen Cyberespionage Recruitment
Kremlin-backed crypto coin moves $6bn despite US sanctions
Cooper’s £4m plan to turn tables on Russian hackers
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
North Korea
North Korean hackers stole $2 billion in crypto this year: report - UPI.com
OpenAI Disrupts Russian, North Korean, and Chinese Hackers Misusing ChatGPT for Cyberattacks
Tools and Controls
Cyber cover concerns remain for risk managers – FERMA
Cyber insurance should complement, not replace, cybersecurity: FERMA - Reinsurance News
Invite us to your cyber war games, Finra urges members - Risk.net
GreyNoise detects 500% surge in scans targeting Palo Alto Networks portals
Hackers Exploit RMM Tools to Deploy Malware - InfoRiskToday
Why Brand Impersonation Is A Marketing Crisis, Not Just A Cybersecurity Problem
Cybersecurity Tops CFO’s Risk Agenda With 99% Reporting Incidents and 94% Planning to Increase Spend
Six metrics policymakers need to track cyber resilience - Help Net Security
NCSC: Observability and Threat Hunting Must Improve - Infosecurity Magazine
Hundreds of free VPNs offer 'no real privacy at all,' researchers warn - does yours? | ZDNET
Are VPNs Under Attack? An Anti-Censorship Group Speaks Out - CNET
How CISOs can get out of security debt and why it matters | TechTarget
Ransomware Gangs Leverage Remote Access Tools to Gain Persistence and Evade Defenses
Take Note: Cyber-Risks With AI Notetakers
Edge device security: The frontline of your network - Security Boulevard
Google's New AI Doesn't Just Find Vulnerabilities — It Rewrites Code to Patch Them
Reports Published in the Last Week
Comcast Business Releases 2025 Cybersecurity Threat Report Analyzing 34.6 Billion Events
Other News
Cybersecurity concerns on the rise for consumers
Nearly half of Brits now talk cybersecurity over the kitchen table, research by Mastercard finds
Invite us to your cyber war games, Finra urges members - Risk.net
How CISOs can get out of security debt and why it matters | TechTarget
Experts Warn The Internet Will Go Down In A Big Way — And You'd Better Be Ready
Microsoft: Hackers target universities in “payroll pirate” attacks
ING's CISO on How Emerging Tech and Regulations are Reshaping Cybersec - Infosecurity Magazine
Stop trusting your ISP's router blindly
Hacktivists target critical infrastructure, hit decoy plant
Securing the final frontier: the new legal urgency of cyber security in space
Vulnerability Management
Vulnerabilities
Oracle Rushes Patch for CVE-2025-61882 After Cl0p Exploited It in Data Theft Attacks
CISA Warns of Windows Privilege Escalation Vulnerability Exploited in Attacks
Microsoft: Critical GoAnywhere bug exploited in ransomware attacks
Zimbra users targeted in zero-day exploit using iCalendar attachments
Google Pixel October security patch continues to fix haunting display problems | Android Central
Hackers Exploit WordPress Sites to Power Next-Gen ClickFix Phishing Attacks
Critical Vulnerability Puts 60,000 Redis Servers at Risk of Exploitation - SecurityWeek
Critical Exploit Lets Hackers Bypass Authentication in WordPress Service Finder Theme
7-Zip Vulnerabilities Let Attackers Execute Arbitrary Code Remotely
Google won’t fix new ASCII smuggling attack in Gemini
CometJacking: One Click Can Turn Perplexity's Comet AI Browser Into a Data Thief
CVE-2025-5947: WordPress Plugin flaw lets hackers access Admin accounts
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 03 October 2025
Black Arrow Cyber Threat Intelligence Briefing 03 October 2025:
-IT Provider Probed as Possible Entry Point in JLR and M&S Breaches
-Security Leaders See Attacks Growing in Frequency and Impact
-Expert Says Basic Security Lapses Still Drive High Profile Breaches
-Russian Vessel Suspected of Mapping Europe’s Undersea Cables
-Hiscox: 80% Of Victims Paid Ransoms and Many Faced Extra Demands
-Allianz: Ransomware Still Drives Large Claims as Criminals Focus on Data Theft
-How Criminals Use AI To Supercharge Phishing and Scams
-Proofpoint: Phishing Remains the Leading Breach Path as AI Raises the Stakes
-ENISA: Phishing Dominated EU Intrusions Over the Past Year
-Phishing Is Shifting to Mobile Channels and Security Must Follow
-Survey Finds Most Workers Cannot Spot AI-Written Phishing Emails
-Researchers Demonstrate Real-Time Voice Cloning for Vishing Attacks
-Okta Warns of North Korean Fake IT Workers Targeting More Sectors
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
We report this week how organisations are attacked through their IT provider, highlighting that business leaders need to understand their third-party and outsourcing risks. Business leaders are seeing various attacks growing in frequency and impact; the solutions are relatively simple but require the leadership to take ownership of security and also prepare how to manage an incident.
We see several stories this week about phishing, which is still a favourite attack route and is made more impactful through AI. We also include a report on organisations that pay ransoms and how this leads to further demands from the attackers.
Our message remains constant and clear: to be more secure and resilient against attacks, business leaders need to upskill on cyber fundamentals and govern cyber risks akin to other risks by working with control providers across technology, operations and people. In our view, the risks grow when cyber security is considered an operational IT topic. Contact us to find out the key risks and how to improve security and resilience in a pragmatic and proportionate manner.
Top Cyber Stories of the Last Week
IT Provider Probed as Possible Entry Point in JLR and M&S Breaches
A report explores whether IT helpdesks run by a major outsourcer became an easy route for attackers during recent UK retail and automotive incidents. Politicians have requested clarity on the outsourcer’s role, and prior NCSC guidance warned that password reset teams are prime targets. The piece underlines the importance of boards correctly understanding their third party and outsourcing risks.
Source: https://www.telegraph.co.uk/business/2025/09/26/suspected-weak-link-in-jaguar-land-rover-ms-hacks/
Security Leaders See Attacks Growing in Frequency and Impact
A survey highlights that executives report more frequent attacks and bigger consequences year on year. Many fear nation state activity will expand beyond government into commercial sectors, while AI is seen as both an accelerator for attackers and a tool for defenders. The findings point to greater attention on supply chain security, incident reporting to executives, and the need for leaders to ensure they can correctly respond to an incident.
Source: https://www.helpnetsecurity.com/2025/09/29/cyberattacks-frequency-impact-growth/
Expert Says Basic Security Lapses Still Drive High Profile Breaches
Recent attacks on well known brands highlight that simple mistakes remain common. The analysis stresses credential hygiene, stronger authentication and supplier dependency management, noting how outages ripple through manufacturing ecosystems and put smaller partners at risk.
Source: https://www.rte.ie/news/business/2025/0930/1536021-cyber-security-data/
Russian Vessel Suspected of Mapping Europe’s Undersea Cables
Satellite data revealed a Russian ship operating near critical energy and telecoms cables in European waters. Experts warn this activity aligns with Moscow’s strategy to prepare covert disruption options in case of conflict. The vessel can intercept communications and potentially plant explosives, raising concerns about resilience of subsea infrastructure vital to energy and data flows.
Hiscox: 80% Of Victims Paid Ransoms and Many Faced Extra Demands
An insurer’s study finds most SME victims that paid ransoms did not fully recover data and a sizeable share received follow on demands. The wider dataset shows more firms reporting attacks and citing AI exposure, underlining the business case for recovery readiness and governance over whether to pay ransoms.
Source: https://news.sky.com/story/cyber-attacks-80-of-ransomware-victims-pay-up-insurer-says-13441131
Allianz: Ransomware Still Drives Large Claims as Criminals Focus on Data Theft
In H1 2025 ransomware represented about 60% of €1m plus claims. Attackers increasingly exfiltrate data to force payment, and SMEs are being hit harder while large firms’ resilience improves. Social engineering and compromised credentials remain common entry points.
Source: https://www.helpnetsecurity.com/2025/10/01/insurance-claims-ransomware-h1-2025/
How Criminals Use AI To Supercharge Phishing and Scams
Threat actors use generative AI to clone voices and faces, craft believable messages, and spin up fraudulent websites at speed. The post outlines how romance and investment scams are scaled by chatbots, and why cross channel verification and layered controls are needed to counter deepfakes and synthetic identities.
Source: https://www.kaspersky.co.uk/blog/ai-phishing-and-scams/29518/
Proofpoint: Phishing Remains the Leading Breach Path as AI Raises the Stakes
At its annual event, Proofpoint highlighted email as the dominant route to compromise and detailed how AI is being used by both attackers and defenders. The firm shared telemetry on scanning billions of messages and noted widespread risky user behaviour, reinforcing the need for controls that assume fallible humans.
Source: https://www.techrepublic.com/article/news-proofpoint-conference-ai-email-security-phishing/
ENISA: Phishing Dominated EU Intrusions Over the Past Year
The European Union Agency for Cyber Security (ENISA) assessment finds phishing accounted for 60% of observed initial access, ahead of vulnerability exploitation. DDoS featured in a high number of incidents, and hacktivists were using social media and other routes to promote their activity. The report stresses the interdependency risks in European supply chains and the growing use of AI to scale social engineering.
Source: https://www.infosecurity-magazine.com/news/phishing-dominates-euwide/
Phishing Is Shifting to Mobile Channels and Security Must Follow
Analysis argues attackers increasingly bypass email to reach users via SMS, voice and QR codes, often evading enterprise controls. Organisations are urged to extend protection to mobile and collaboration apps and to focus on human layer detection and response.
Source: https://www.darkreading.com/cyber-risk/phishing-moving-email-mobile-is-your-security
Survey Finds Most Workers Cannot Spot AI-Written Phishing Emails
Research shows 54% of respondents failed to identify phishing emails crafted by AI, with younger staff most vulnerable. Nearly 40% have never received cyber security training, and MFA adoption remains below 50%. The findings underline the urgency for awareness programmes and layered defences as AI makes social engineering harder to detect.
Researchers Demonstrate Real-Time Voice Cloning for Vishing Attacks
Security experts successfully used AI to clone voices in real time during simulated attacks, convincing targets to perform sensitive actions such as password resets. The technique bypasses traditional safeguards and exploits trust in familiar caller IDs. Businesses are urged to strengthen verification processes for voice-based requests.
Okta Warns of North Korean Fake IT Workers Targeting More Sectors
Okta’s research tracks thousands of fraudulent job interviews by DPRK linked actors posing as remote developers. Targets now include healthcare, finance and AI companies, not just big tech. The activity aims to generate revenue and enable access for further abuses, reinforcing the need for stronger hiring verification and endpoint controls.
Source: https://www.theregister.com/2025/09/30/north_korean_it_workers_okta/
Governance, Risk and Compliance
Cybersecurity leaders underreport cyber incidents to executives - Help Net Security
Companies are facing more cyberattacks than ever before - and many just can't cope | TechRadar
Budgets, Staffing and Skills Fail to Keep Pace With Rising Cyber Threats, Finds New ISACA Research
Security risks leave 84 percent of IT pros feeling stressed at work - BetaNews
SMEs to step up cyber defences as over half experience cyber attack in past year - Insurance Age
High profile cyber attacks often down to basic errors
Why is everything being hacked? - New Statesman
CIISec Members Say Budgets Are Falling Behind Threats - Infosecurity Magazine
The warning signs are clear: We’re heading toward a digital crisis
Why burnout is a growing problem in cybersecurity - BBC News
Two-Thirds of Organizations Have Unfilled Cybersecurity Positions - Infosecurity Magazine
Threats
Ransomware, Extortion and Destructive Attacks
High profile cyber attacks often down to basic errors
New LockBit Ransomware Variant Emerges as Most Dangerous Yet - Infosecurity Magazine
Akira ransomware: From SonicWall VPN login to encryption in under four hours - Help Net Security
Scattered Spider, ShinyHunters Restructure - New Attacks Underway
Cyber attacks: '80%' of ransomware victims pay up, insurer says | Money News | Sky News
Ransomware remains the leading cause of costly cyber claims - Help Net Security
Organisations struggle to recognise lingering effects of ransomware - TechCentral.ie
Third of cyber security professionals feel guilt over ransomware attacks - TechCentral.ie
Ransomware gang sought BBC reporter’s help in hacking media giant
Attackers Use AI to Build Ransomware at Rapid Scale
Google Sheds Light on ShinyHunters' Salesforce Tactics
Why The US Just Put An $11M Dollar Bounty On This Ukranian Hacker
Ransomware is becoming a psy-ops assault on healthcare executives | SC Media
Ransomware Victims
The suspected weak link in the Jaguar Land Rover and M&S hacks
UK giants hit by cyberattacks: how Co-op, M&S, JLR disruption expose vulnerabilities | Invezz
UK Has Suffered at Least 26 Major Cyberattacks in Last Five Years – Guido Fawkes
Over three-quarters of West Midlands firms feel impact of JLR cyber-attack - The Stratford Observer
Red Hat confirms security incident after hackers claim GitHub breach
Japan's beer giant Asahi Group cannot resume production after cyberattack | Reuters
Hackers say they have deleted children's pictures and data after nursery attack backlash - BBC News
Google warns of Cl0p extortion campaign against Oracle E-Business users
Data breach at dealership software provider impacts 766k clients
Hackers claim theft of Boeing supplier documents | Cybernews
Phishing & Email Based Attacks
Phishing Is Moving to Mobile. Is Your Security?
UK IT Leaders Warn That Email Is the Front Door for Cyber Risk - and It’s Still Wide Open
Proofpoint Exec: 'Phishing is the Leading Cause of Breaches Globally'
How attackers poison AI tools and defenses - Help Net Security
Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security
Phishing Dominates EU-Wide Intrusions, says ENISA - Infosecurity Magazine
Foreign states ramp up cyber attacks on EU with AI-driven phishing and DDoS campaigns | IT Pro
New MatrixPDF toolkit turns PDFs into phishing and malware lures
Ukrainian Cops Spoofed in Fileless Phishing on Kyiv
Business Email Compromise (BEC)/Email Account Compromise (EAC)
AI-Powered Voice Cloning Raises Vishing Risks
North Korea’s fake IT workers targeting healthcare, finance • The Register
Real-Time AI Voice Cloning Powers Convincing Vishing Attacks
Your Service Desk is the New Attack Vector—Here's How to Defend It.
Cyber criminals from Russia and Iran target MoD staff with fake LinkedIn job ads
That annoying SMS phish you just got may have come from a box like this - Ars Technica
Other Social Engineering
AI-Powered Voice Cloning Raises Vishing Risks
North Korea’s fake IT workers targeting healthcare, finance • The Register
Your Service Desk is the New Attack Vector—Here's How to Defend It.
Cyber criminals from Russia and Iran target MoD staff with fake LinkedIn job ads
That annoying SMS phish you just got may have come from a box like this - Ars Technica
Fraud, Scams and Financial Crime
Brits warned as illegal robo-callers fined £550,000 • The Register
Interpol sting operation across Africa sees 260 arrested for sextortion and romance scams - BBC News
Artificial Intelligence
AI-Powered Voice Cloning Raises Vishing Risks
Proofpoint Exec: 'Phishing is the Leading Cause of Breaches Globally'
Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security
Foreign states ramp up cyber attacks on EU with AI-driven phishing and DDoS campaigns | IT Pro
Attackers Use AI to Build Ransomware at Rapid Scale
LLM-Based LAMEHUG Malware Dynamically Generate Commands for Reconnaissance and Data Theft
UN seeks to build consensus on ‘safe, secure and trustworthy’ AI | CyberScoop
EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
Beware! Threat Actors Distributing Malicious AI Tools as Chrome Extensions - Cyber Security News
Dark side of the boom: How hackers are vibing with AI - The Economic Times
The hidden cyber risks of deploying generative AI
Google Gemini Vulnerabilities Let Attackers Exfiltrate User’s Saved Data and Location
Google Patches Gemini AI Hacks Involving Poisoned Logs, Search Results - SecurityWeek
New Android Trojan "Datzbro" Tricking Elderly with AI-Generated Facebook Travel Events
2FA/MFA
Gone in 60 Minutes: Akira Defeats MFA for SonicWall SSL VPNs
Losing your phone on a trip? Brutal. Not doing these 3 things first? Security nightmare | PCWorld
Malware
LLM-Based LAMEHUG Malware Dynamically Generate Commands for Reconnaissance and Data Theft
EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
Beware! Threat Actors Distributing Malicious AI Tools as Chrome Extensions - Cyber Security News
New MatrixPDF toolkit turns PDFs into phishing and malware lures
Weaponized Malwarebytes, LastPass, Citibank, SentinelOne, and Others on GitHub Deliver Malware
Hackers Injecting Exploiting WordPress Websites With Silent Malware to Gain Admin Access
Fake Microsoft Teams installers push Oyster malware via malvertising
Security Bite: Mac users are finally taking malware seriously, per new report - 9to5Mac
Fake Postmark MCP npm package stole emails with one-liner • The Register
Microsoft leaves Mac users exposed to GitHub Mac malware
Confucius Shifts from Document Stealers to Python Backdoors - Infosecurity Magazine
Researchers Expose SVG and PureRAT Phishing Threats Targeting Ukraine and Vietnam
Microsoft uncovers new variant of XCSSET macOS malware in targeted attacks
China-linked APT Phantom Taurus uses Net-Star malware in espionage campaigns against key sectors
New COLDRIVER Malware Campaign Joins BO Team and Bearlyfy in Russia-Focused Cyberattacks
Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs
Mobile
Phishing Is Moving to Mobile. Is Your Security?
Losing your phone on a trip? Brutal. Not doing these 3 things first? Security nightmare | PCWorld
Brits warned as illegal robo-callers fined £550,000 • The Register
That annoying SMS phish you just got may have come from a box like this - Ars Technica
New Android RAT Klopatra Targets Financial Data - Infosecurity Magazine
Android malware uses VNC to give attackers hands-on access
How Android 16 Will Detect Fake Cell Towers To Help Keep You Safe
Apple Updates iOS and macOS to Prevent Malicious Font Attacks - SecurityWeek
New Android Trojan "Datzbro" Tricking Elderly with AI-Generated Facebook Travel Events
Smishing Campaigns Exploit Cellular Routers to Target Belgium - Infosecurity Magazine
Denial of Service/DoS/DDoS
Foreign states ramp up cyber attacks on EU with AI-driven phishing and DDoS campaigns | IT Pro
Council website down as group claims Suffolk and Essex cyber-attacks - BBC News
Internet of Things – IoT
Tile security flaws can let stalkers track your location, and more
Data Breaches/Leaks
LLM-Based LAMEHUG Malware Dynamically Generate Commands for Reconnaissance and Data Theft
Red Hat breach might affect major organizations | Cybernews
Unofficial Postmark MCP npm silently stole users' emails
Oracle customers being bombarded with emails claiming widespread data theft | CyberScoop
Salesforce faces class action after Salesloft breach • The Register
Harrods hit by second cyber attack in six months | Computer Weekly
1.5 Million Impacted by Allianz Life Data Breach - SecurityWeek
Latest Airline Security Breach Leaks Passports, IDs, Other Info
WestJet confirms cyberattack exposed IDs, passports in June incident
Data breach at dealership software provider impacts 766k clients
Hackers claim theft of Boeing supplier documents | Cybernews
Air Force admits SharePoint privacy issue; reports of breach • The Register
Sex offenders, terrorists, drug dealers, exposed in spyware breach | Malwarebytes
Organised Crime & Criminal Actors
UK convicts "Bitcoin Queen" in world’s largest cryptocurrency seizure
Inside Dark Web Exploit Markets in 2025: Pricing, Access & Active Sellers
UK Police Just Seized £5.5 Billion in Bitcoin — The World's Largest Crypto Bust
Why The US Just Put An $11M Dollar Bounty On This Ukranian Hacker
Interpol sting operation across Africa sees 260 arrested for sextortion and romance scams - BBC News
Beijing-backed burglars target government web servers • The Register
UK Government Wants to Keep $7 Billion in Stolen Bitcoin It Has Seized - Decrypt
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
£5.5B Bitcoin fraudster pleads guilty after years on the run • The Register
UK Police Just Seized £5.5 Billion in Bitcoin — The World's Largest Crypto Bust
UK Government Wants to Keep $7 Billion in Stolen Bitcoin It Has Seized - Decrypt
Insider Risk and Insider Threats
North Korea’s fake IT workers targeting healthcare, finance • The Register
Ransomware gang sought BBC reporter’s help in hacking media giant
'You'll never need to work again': Criminals offer reporter money to hack BBC - BBC News
Insurance
Ransomware remains the leading cause of costly cyber claims - Help Net Security
Cyber attacks: '80%' of ransomware victims pay up, insurer says | Money News | Sky News
Cyber insurance claims steady, but risk environment remains complex | Insurance Business America
More CVEs, But Cyber Insurers Aren't Altering Policies
Calls for mandatory reporting as 59% of SMEs hit by cyber attacks | Insurance Times
Zurich urges national cybersecurity metrics adoption | Insurance Business America
Supply Chain and Third Parties
The suspected weak link in the Jaguar Land Rover and M&S hacks
Over three-quarters of West Midlands firms feel impact of JLR cyber-attack - The Stratford Observer
Hackers claim theft of Boeing supplier documents | Cybernews
Software Supply Chain
Fake Postmark MCP npm package stole emails with one-liner • The Register
Cloud/SaaS
Fake Microsoft Teams installers push Oyster malware via malvertising
$50 Battering RAM Attack Breaks Intel and AMD Cloud Security Protections
Critical WD My Cloud bug allows remote command injection
Air Force admits SharePoint privacy issue; reports of breach • The Register
Outages
Afghanistan hit by communications blackout after Taliban shuts internet | Afghanistan | The Guardian
Encryption
UK once again demands backdoor to Apple’s encrypted cloud storage - Ars Technica
Linux and Open Source
Linux Kernel ksmbd Vulnerability Allows Remote Attackers to Execute Arbitrary Code
The hidden risks inside open-source code - Help Net Security
Organizations Warned of Exploited Sudo Vulnerability - SecurityWeek
Passwords, Credential Stuffing & Brute Force Attacks
Losing your phone on a trip? Brutal. Not doing these 3 things first? Security nightmare | PCWorld
NIST’s new password rules | Cybernews
Social Media
Imgur blocks UK users after data watchdog signals possible fine
New Android Trojan "Datzbro" Tricking Elderly with AI-Generated Facebook Travel Events
UK minister suggests government could leave Elon Musk's X • The Register
Cyber criminals from Russia and Iran target MoD staff with fake LinkedIn job ads
Malvertising
Fake Microsoft Teams installers push Oyster malware via malvertising
Regulations, Fines and Legislation
Imgur blocks UK users after data watchdog signals possible fine
NIS2 and DORA explained: What Every Business Leader Needs to Know - Infosecurity Magazine
Brits warned as illegal robo-callers fined £550,000 • The Register
Shutdown Threat Puts Federal Cyber on Edge - InfoRiskToday
Cyber threat-sharing law set to lapse as govt shutdown looms • The Register
CISA kills agreement with nonprofit that runs MS-ISAC • The Register
UK once again demands backdoor to Apple’s encrypted cloud storage - Ars Technica
UK to roll out digital ID for right to work by 2029 • The Register
Six-month reporting obligation for cyberattacks on critical infrastructures
Department of War Launches New Cybersecurity Framework
Models, Frameworks and Standards
NIS2 and DORA explained: What Every Business Leader Needs to Know - Infosecurity Magazine
NIST’s new password rules | Cybernews
Careers, Working in Cyber and Information Security
Budgets, Staffing and Skills Fail to Keep Pace With Rising Cyber Threats, Finds New ISACA Research
Security risks leave 84 percent of IT pros feeling stressed at work - BetaNews
Why burnout is a growing problem in cybersecurity - BBC News
Two-Thirds of Organizations Have Unfilled Cybersecurity Positions - Infosecurity Magazine
Law Enforcement Action and Take Downs
UK convicts "Bitcoin Queen" in world’s largest cryptocurrency seizure
UK Police Just Seized £5.5 Billion in Bitcoin — The World's Largest Crypto Bust
Interpol sting operation across Africa sees 260 arrested for sextortion and romance scams - BBC News
UK Government Wants to Keep $7 Billion in Stolen Bitcoin It Has Seized - Decrypt
Why The US Just Put An $11M Dollar Bounty On This Ukranian Hacker
Dutch teens arrested for trying to spy on Europol for Russia
Misinformation, Disinformation and Propaganda
Despite Russian Influence, Moldova Votes Pro-EU, Highlighting Future Election Risks
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Britain may already be at war with Russia, former head of MI5 says | Defence policy | The Guardian
Germany “not at war, but no longer at peace”: Merz - Euromaidan Press
Investigation finds Russian surveillance, sabotage ship near European undersea cables, FT reports
Macron warns of 'secret army' of Russian bots destroying Western democracies from within | УНН
NATO’s Article 4 Alert: The Path to Disentanglement - The National Interest
Western Countries In Cyber ‘Arms Race,' Ex-UK Cyber Chief Warns | Miami Herald
Danish PM calls for strong answer from EU leaders to Russia's hybrid attacks - BBC News
Nation State Actors
Western Countries In Cyber ‘Arms Race,' Ex-UK Cyber Chief Warns | Miami Herald
Submarine cable security is all at sea • The Register
Met warns that hostile states are recruiting youths for crime - BBC News
China
New China APT Strikes With Precision and Persistence
The China Threat to UK Firms | SC Media UK
Western Countries In Cyber ‘Arms Race,' Ex-UK Cyber Chief Warns | Miami Herald
Russia, Chinese Hacking Buffets Europe - GovInfoSecurity
Chinese hackers exploiting VMware zero-day since October 2024
German infrastructure hit by drones, cybercrime, arson – DW – 09/30/2025
China-linked APT Phantom Taurus uses Net-Star malware in espionage campaigns against key sectors
Beijing-backed burglars target government web servers • The Register
Russia
Britain may already be at war with Russia, former head of MI5 says | Defence policy | The Guardian
Western Countries In Cyber ‘Arms Race,' Ex-UK Cyber Chief Warns | Miami Herald
Russia, Chinese Hacking Buffets Europe - GovInfoSecurity
Investigation finds Russian surveillance, sabotage ship near European undersea cables, FT reports
The Russian spy ship stalking Europe’s subsea cables
Macron warns of 'secret army' of Russian bots destroying Western democracies from within | УНН
NATO’s Article 4 Alert: The Path to Disentanglement - The National Interest
German infrastructure hit by drones, cybercrime, arson – DW – 09/30/2025
Danish PM calls for strong answer from EU leaders to Russia's hybrid attacks - BBC News
Cyber criminals from Russia and Iran target MoD staff with fake LinkedIn job ads
Dutch teens arrested for trying to spy on Europol for Russia
Despite Russian Influence, Moldova Votes Pro-EU, Highlighting Future Election Risks
New COLDRIVER Malware Campaign Joins BO Team and Bearlyfy in Russia-Focused Cyberattacks
Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs
Ukrainian Cops Spoofed in Fileless Phishing on Kyiv
Iran
Western Countries In Cyber ‘Arms Race,' Ex-UK Cyber Chief Warns | Miami Herald
Cyber criminals from Russia and Iran target MoD staff with fake LinkedIn job ads
Met warns that hostile states are recruiting youths for crime - BBC News
North Korea
North Korea’s fake IT workers targeting healthcare, finance • The Register
Western Countries In Cyber ‘Arms Race,' Ex-UK Cyber Chief Warns | Miami Herald
Tools and Controls
How attackers poison AI tools and defenses - Help Net Security
Budgets, Staffing and Skills Fail to Keep Pace With Rising Cyber Threats, Finds New ISACA Research
Ransomware remains the leading cause of costly cyber claims - Help Net Security
Cyber attacks: '80%' of ransomware victims pay up, insurer says | Money News | Sky News
CIISec Members Say Budgets Are Falling Behind Threats - Infosecurity Magazine
Apple strengthens storage flexibility with new disk image formats - Help Net Security
Datacenter fire downs 647 South Korean government services • The Register
NIST’s new password rules | Cybernews
The hidden cyber risks of deploying generative AI
Cybersecurity professionals under pressure turn to AI amid rising threats | Fortune
What to know about 5G security threats in the enterprise | TechTarget
Microsoft Edge will soon protect against risky sideloaded extensions | PCWorld
Agentic AI in IT security: Where expectations meet reality | CSO Online
AI Tops Cybersecurity Investment Priorities, PwC Finds - Infosecurity Magazine
Microsoft Outlook stops displaying inline SVG images used in attacks
Pentagon relaxes military cybersecurity training • The Register
Cyber risk quantification helps CISOs secure executive support - Help Net Security
Other News
SMEs to step up cyber defences as over half experience cyber attack in past year - Insurance Age
Calls for mandatory reporting as 59% of SMEs hit by cyber attacks | Insurance Times
Datacenter fire downs 647 South Korean government services • The Register
90 percent of organizations face attacks involving lateral movement - BetaNews
UK at risk of 'cyber 9/11' wiping out internet for days
Many Attacks Aimed at EU Targeted OT, Says Cybersecurity Agency - SecurityWeek
Securing the Journey: Cybersecurity Challenges in the Tourism Industry - Security Boulevard
A breach every month raises doubts about South Korea's digital defenses | TechCrunch
Why Airlines & Airports Must Do More To Defend Against Cyberattacks
Pentagon relaxes military cybersecurity training • The Register
Vulnerability Management
CISOs advised to rethink vulnerability management as exploits sharply rise | CSO Online
More CVEs, But Cyber Insurers Aren't Altering Policies
UK and US urge Cisco users to ditch end-of-life security appliances | Computer Weekly
The hidden risks inside open-source code - Help Net Security
Vulnerabilities
Gone in 60 Minutes: Akira Defeats MFA for SonicWall SSL VPNs
Nearly 50,000 Cisco firewalls vulnerable to actively exploited flaws
High-Severity Vulnerabilities Patched in VMware Aria Operations, NSX, vCenter - SecurityWeek
UK and US urge Cisco users to ditch end-of-life security appliances | Computer Weekly
Chinese hackers exploiting VMware zero-day since October 2024
Linux Kernel ksmbd Vulnerability Allows Remote Attackers to Execute Arbitrary Code
Apple Updates iOS and macOS to Prevent Malicious Font Attacks - SecurityWeek
Google Gemini Vulnerabilities Let Attackers Exfiltrate User’s Saved Data and Location
Hackers Actively Scanning to Exploit Palo Alto Networks PAN-OS Global Protect Vulnerability
OpenSSL Vulnerabilities Let Attackers Execute Malicious Code and Recover Private Key Remotely
Adobe Analytics bug leaked customer tracking data to other tenants
'Delightful' Red Hat OpenShift AI bug allows full takeover • The Register
Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability - SecurityWeek
Chrome 141 and Firefox 143 Patches Fix High-Severity Vulnerabilities - SecurityWeek
CISA warns of critical Linux Sudo flaw exploited in attacks
New bug in classic Outlook can only be fixed via Microsoft support
WD patches NAS security flaw which could have allowed full takeover | TechRadar
Hackers exploit Fortra GoAnywhere flaw before public alert
Notepad++ DLL Hijacking Vulnerability Let Attackers Execute Malicious Code
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 26 September 2025
Black Arrow Cyber Threat Intelligence Briefing 26 September 2025:
-Finance Professionals Rank Cyber as The Top Risk for 2026
-UK Co-operative Group Counts a £200m Sales Hit from Its April Cyber Incident
-Tata Motors Shares Drop 5% after JLR Cyber Attack
-Airport Outages Expose Fragile Links in Aviation Supply Chains
-Attackers Focus on MFA Bypass and Supply Chain Routes
-Insurer Reclaiming Costs from Technology Providers
-Ransomware Crews Multiply and Focus on Data Theft
-Phishing Surges as The Top Doorway for Ransomware In 2025
-Phishing Campaigns Spread Beyond Email as Criminals Exploit New Channels
-Generative AI Attacks Accelerate with Deepfakes and Malicious Prompts
-Stolen Credentials Fuel a Thriving Cybercrime Marketplace
-China Linked Attackers Embedded in Many Enterprises
-Law Firms Face Mounting Raids on Sensitive Client Files
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
Cyber risk continues to dominate the business agenda, with incidents showing the scale of disruption and loss. A recurring insight this week is that attackers often remain undetected for long periods, exploiting MFA weaknesses and third-party flaws; supply chain risks are also prominent. The threat landscape is evolving: phishing is spreading beyond email, stolen credentials fuel cybercrime, and generative AI introduces deepfakes and malicious prompts.
To address these challenges, business leaders need an objective view of their risks and should establish their cyber strategy across people, operations and technology. Independent testing of response plans and governance over suppliers and AI systems are essential; cyber resilience must be led from the top, not delegated to IT.
Top Cyber Stories of the Last Week
Finance Professionals Rank Cyber as The Top Risk for 2026
Cyber security has emerged as the most significant threat to businesses, with over eight in ten chief internal auditors naming it their primary concern. Recent incidents targeting major UK firms and critical infrastructure have exposed severe financial and operational impacts, with some organisations facing losses in the hundreds of millions and prolonged supply chain disruption. The Chartered Institute of Internal Auditors cautions that attacks are becoming increasingly common and advanced, often fuelled by developments in artificial intelligence.
UK Co-operative Group Counts a £200m Sales Hit from Its April Cyber Incident
The Co-operative Group has disclosed widespread disruption and financial impact following a cyber attack in April. The incident affected multiple business units, including funeral services, and led to a substantial drop in sales, reportedly exceeding £200 million. Member data was compromised, and the organisation posted a significant pre-tax loss for the first half of the year. Senior executives acknowledged the event exposed both operational strengths and areas requiring improvement, with further consequences anticipated in the months ahead.
Tata Motors Shares Drop 5% after JLR Cyber Attack
Jaguar Land Rover continues to grapple with a serious cyber incident that has halted production at UK facilities and affected tens of thousands of employees. The company has extended its operational pause while investigations proceed, and analysts suggest the financial impact could be considerable. Reports indicate the firm lacked cyber insurance coverage for this event, and the disruption is believed to be costing millions each week, posing reputational and financial challenges for both JLR and its parent company.
Airport Outages Expose Fragile Links in Aviation Supply Chains
Recent cyber attacks at major European airports disrupted check-in and boarding after hackers targeted Collins Aerospace’s Muse software, which manages shared airport systems. The incident highlighted the vulnerabilities linked to third-party dependencies, with operational and reputational consequences spreading rapidly across multiple countries. The case emphasises the importance of robust supply chain governance, ongoing monitoring, and well-tested recovery strategies, as weaknesses in external vendors can be just as damaging as breaches within an organisation’s own systems.
Attackers Focus on MFA Bypass and Supply Chain Routes
Attackers are increasingly exploiting weaknesses in identity and access controls, with Ontinue’s mid-2025 report highlighting a sharp rise in supply chain incidents, which now account for nearly a third of cyber cases. Almost 40% of cloud intrusions involved multiple hidden access methods, enabling attackers to remain undetected for weeks, while 20% used token replay to bypass multi-factor authentication. Phishing campaigns using image-based email attachments grew by 70%, and USB-based attacks surged by more than a quarter. The report stresses the need for stronger identity safeguards, closer supplier oversight and tighter control of overlooked entry points.
Insurer Reclaiming Costs from Technology Providers
ACE American Insurance, part of Chubb, is pursuing legal action against two technology vendors after reimbursing ransomware-related losses for staffing firm CoWorx. The insurer claims the cloud provider failed to implement adequate security controls, including strong authentication, while the monitoring firm did not respond effectively to early warning signs. These alleged lapses enabled attackers to encrypt systems and demand payment. ACE is seeking compensation through claims of negligence and breach of contract.
https://www.claimsjournal.com/news/national/2025/09/22/333061.htm
Ransomware Crews Multiply and Focus on Data Theft
Ransomware activity continues to surge, with more than 3,700 victims in the first half of 2025; a 20% increase on late 2024 and 67% higher year-on-year. The growth is fuelled by a rental model where criminals lease tools to affiliates, enabling more attacks with less effort. Nearly 90 groups were active, including 35 new entrants, making threats harder to track. North America and Europe remain prime targets, with NATO members accounting for 65% of cases. Increasingly, attackers focus on stealing and threatening to release data, highlighting the need for stronger early detection.
https://www.helpnetsecurity.com/2025/09/26/report-2025-ransomware-attack-trends/
Phishing Surges as The Top Doorway for Ransomware In 2025
Phishing has emerged as the leading method for ransomware delivery, with a marked increase in incidents compared to the previous year. A recent report shows that nearly nine in ten organisations experienced ransomware-related events, and many faced repeated attacks. The proliferation of phishing-as-a-service tools has lowered the barrier for entry, enabling less sophisticated actors to launch damaging campaigns. Despite confidence in existing defences, many firms lack robust procedures to manage identity exposure and investigate breaches
https://betanews.com/2025/09/23/phishing-is-now-the-main-entry-point-for-ransomware/
Phishing Campaigns Spread Beyond Email as Criminals Exploit New Channels
Phishing is no longer confined to email. Attackers are increasingly leveraging social media, messaging apps, and malicious ads to distribute fraudulent links. This trend exploits the fact that employees often access personal apps on work devices, creating new entry points for attackers. Reports highlight that more than 60% of stolen login details now come from social media sites, making them a prime target. Once an account is compromised, attackers can gain access to critical business systems and data, with the potential for widespread breaches. Traditional email-focused defences are no longer sufficient to address this risk.
Generative AI Attacks Accelerate With Deepfakes and Malicious Prompts
Threats linked to generative AI are rising sharply, with a growing number of organisations reporting incidents involving deepfakes and prompt manipulation. Fake audio is increasingly used to deceive staff and bypass controls, while AI assistants are being targeted through crafted inputs. Gartner advises that existing security frameworks must evolve to address these risks, and anticipates that proactive AI protection will represent a significant share of security budgets by the end of the decade.
https://www.itpro.com/security/generative-ai-attacks-are-accelerating-at-an-alarming-rate
Stolen Credentials Fuel a Thriving Cybercrime Marketplace
An expanding underground economy is centred around stolen digital identities, with login credentials traded as valuable assets. Financial institutions are particularly exposed, facing substantial losses per breach. Attackers often exploit weak identity governance and gaps in AI system security. Despite the scale of the threat, identity protection remains under-prioritised, prompting calls for stronger oversight and executive-level commitment to reduce financial and reputational exposure.
https://www.helpnetsecurity.com/2025/09/26/stolen-identity-cybercrime-economy/
China Linked Attackers Embedded in Many Enterprises
Google warns that suspected China-linked threat actors have compromised multiple organisations since March, often remaining undetected for over a year. Attackers gained access by exploiting flaws in widely used software, installing hidden tools that bypass standard monitoring. Targets have included law firms, technology providers and outsourcing firms, with intruders seeking valuable data and email access from key staff. Google noted the attackers are adapting quickly and scaling their operations, which means more companies are likely to uncover historic or ongoing breaches in the coming years.
https://www.theregister.com/2025/09/24/google_china_spy_report/
Law Firms Face Mounting Raids on Sensitive Client Files
Cyber criminals are increasingly targeting law firms to gain access to confidential client information. Both small practices and large legal organisations are at risk due to outdated systems, insufficient staff training and poor cyber hygiene. One in five firms experienced an attack last year, and nearly 40 percent of those incidents led to data compromise. Some breaches have forced legal bodies offline or resulted in costly settlements. With nation-state actors also involved and emerging threats such as deepfakes, clients are placing greater importance on firms that demonstrate strong and proactive cyber security measures.
https://www.helpnetsecurity.com/2025/09/23/law-firms-cyberthreats/
Governance, Risk and Compliance
Cyber security biggest risk as businesses reel from major attacks | ICAEW
The culture of silence on data breaches has gone too far - Tech Monitor
Cyber attacks cost Europe €300bn in five years, warns Howden | Global Reinsurance
Cyber attacks cost European businesses over €300bn as insurance uptake lags
Cyber Threats Remain a Top Business Concern in Travelers Risk Index
CIO Watercooler Talk: C-Suite Advisors Amid Disruption
What Is Regulatory Compliance? | Definition From TechTarget
48% of Cybersecurity Bosses Failed to Report a Breach This Year
Gartner: Preemptive cybersecurity to dominate 50% of security spend by 2030 - Help Net Security
Hackers target supply chains’ weak links in growing threat to companies
Why IT/Security alignment is the key to efficient operations – Computerworld
Perspective: Why Politics in the Workplace is a Cybersecurity Risk - SecurityWeek
Threats
Ransomware, Extortion and Destructive Attacks
Phishing is now the main entry point for ransomware - BetaNews
How One Bad Password Ended a 158-Year-Old Business
Insurer Says Tech Services Firms Should Pay for Insured’s Ransomware Damages
Known. Emerging. Unstoppable? Ransomware Attacks Still Evade Defenses
Organizations Must Update Defenses to Scattered Spider Tactics, Expert - Infosecurity Magazine
Ransomware groups are multiplying, raising the stakes for defenders - Help Net Security
WarLock ransomware group attack surge | Cybernews
BlackLock Ransomware Attacking Windows, Linux, and VMware ESXi Environments
Scattered Spider Targets Financial Sector After Alleged Retirement | Security Magazine
UK chancellor blames cyberattacks on Russia despite evidence • The Register
GOLD SALEM Compromise Networks and Bypass Security Solutions to Deploy Warlock Ransomware
Suspect arrested in cyberattack on Collins Aerospace check-in software | SC Media
Scattered Spider Member Surrenders Amid Shutdown Claims
Teen arrested in UK was a core figure in Scattered Spider’s operations | CyberScoop
Ransomware Payments vs Rising Incident Counts in 2025 - What’s Changing in RaaS Economics
Another alleged Scattered Spider member arrested • The Register
Vegas cops book teen allegedly involved in casino hacks • The Register
Obscura, an obscure new ransomware variant
INC ransomware: what you need to know | Fortra
Will banning ransom payments help protect UK businesses? - Raconteur
Ransomware Victims
Insurer Says Tech Services Firms Should Pay for Insured’s Ransomware Damages
Jaguar Land Rover to bear full cost of cyber attack due to lack of insurance cover
How One Bad Password Ended a 158-Year-Old Business
Co-op suffers £200m revenue hit as it counts cost of April's cyber attack
Which UK retailers have been hit by cyber attacks in 2025? - Raconteur
A cyberattack on Collins Aerospace disrupted operations at major European airports
Collins Aerospace ‘cyber attack’ latest in series of incidents at UK airports | The Standard
Airlines seen as vulnerable as ransomware confirmed in weekend cyberattack
Jaguar Land Rover Says Shutdown Will Continue Until at Least Oct 1 After Cyberattack - SecurityWeek
Cyber Attack On JLR Should Be A ‘Wake-Up Call’ For British Industry - Minister - PM Today
‘Like a bomb threat’ – Co-op looks forward as it grapples with cyber attack fallout | Retail Week
Volvo Group Employee Data Stolen in Ransomware Attack - SecurityWeek
Scattered Spider Targets Financial Sector After Alleged Retirement | Security Magazine
Was the chancellor right to accuse Russia of being behind recent UK cyber attacks? | ITV News
Phishing & Email Based Attacks
Phishing is now the main entry point for ransomware - BetaNews
17,500 Phishing Domains Target 316 Brands Across 74 Countries in Global PhaaS Surge
Why attackers are moving beyond email-based phishing attacks
How to Spot and Stop Phishing Attacks Before They Happen - DevX
Microsoft spots LLM-obfuscated phishing attack - Help Net Security
AI vs. AI: Detecting an AI-obfuscated phishing campaign | Microsoft Security Blog
Threat Actors Attacking ICS Computers With Malicious Scripts and Phishing Pages
Phishing Campaign Evolves into PureRAT Deployment - Infosecurity Magazine
Other Social Engineering
What to do if your company discovers a North Korean worker in its ranks | CyberScoop
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
How hiring fraud has become a cybersecurity threat vector | Biometric Update
Criminals are driving fake cell towers through cities to blast out scam texts | TechSpot
US employees 'unprepared' for cybersecurity threats - New Study
North Korean IT workers use fake profiles to steal crypto - Help Net Security
Threat Actor’s Using Copyright Takedown Claims to Deploy Malware
Lazarus RAT code resurfaces in North Korean IT-worker scams • The Register
Fraud, Scams and Financial Crime
Criminals are driving fake cell towers through cities to blast out scam texts | TechSpot
FBI Warns of Spoofed IC3 Website - SecurityWeek
Scammers are now faking the FBI's own website - here's how to stay safe | ZDNET
Eurojust Arrests 5 in €100M Cryptocurrency Investment Fraud Spanning 23 Countries
Artificial Intelligence
ChatGPT 'ShadowLeak' Allows Hackers to Steal Emails
Deepfake Attacks Hit Two-Thirds of Businesses - Infosecurity Magazine
Microsoft spots LLM-obfuscated phishing attack - Help Net Security
Hackers are using GPT-4 to build a virtual assistant - here's what we know | TechRadar
‘Harvest Now, Decrypt Later’ Attacks in the Post-Quantum, AI Era - EE Times Europe
AI-Powered App Exposes User Data, Creates Risk of Supply Chain Attacks | Trend Micro (US)
Critical Security Flaws Grow with AI Use, New Report Shows - Infosecurity Magazine
GenAI is exposing sensitive data at scale - Help Net Security
AI is rewriting the rules of cyber defense - Help Net Security
Generative AI attacks are accelerating at an alarming rate | IT Pro
AI needs ethics to avoid real-world harm - Help Net Security
Kaspersky: RevengeHotels returns with AI-coded malware • The Register
Why AI systems may never be secure, and what to do about it
Google's latest AI safety report explores AI beyond human control | ZDNET
2FA/MFA
Threat actors turning to MFA bypass, USB malware and supply chain attacks | SC Media
Malware
Threat actors turning to MFA bypass, USB malware and supply chain attacks | SC Media
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
Threat Actor’s Using Copyright Takedown Claims to Deploy Malware
Beware: GitHub repos distributing Atomic Infostealer on macOS
SystemBC Powers REM Proxy With 1,500 Daily VPS Victims Across 80 C2 Servers
LastPass Warns of Fake Repositories Infecting macOS with Atomic Infostealer
Nimbus Manticore Deploys New Malware Targeting Europe - Check Point Research
Iran-Linked Hackers Target Europe With New Malware
Hacker Deploys 'OVERSTEP' Backdoor in SonicWall Attack
Google: Brickstorm malware used to steal U.S. orgs' data for over a year
BRICKSTORM malware is new Chinese espionage threat | Cybernews
Microsoft warns of new XCSSET macOS malware variant targeting Xcode devs
Lazarus RAT code resurfaces in North Korean IT-worker scams • The Register
New EDR-Freeze tool uses Windows WER to suspend security software
Artifical Intellegence Trained to Attack Hotel Guests
Kaspersky: RevengeHotels returns with AI-coded malware • The Register
Threat Actors Attacking ICS Computers With Malicious Scripts and Phishing Pages
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
Phishing Campaign Evolves into PureRAT Deployment - Infosecurity Magazine
Bots/Botnets
SystemBC Powers REM Proxy With 1,500 Daily VPS Victims Across 80 C2 Servers
Double the Power: New DDoS From 'Aisuru' Botnet Easily Shatters Record
Cloudflare mitigates largest-ever DDoS attack at 22.2 Tbps
New Botnet Leverages DNS Misconfiguration to Launch Massive Cyber Attack
ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Service
Mobile
Criminals are driving fake cell towers through cities to blast out scam texts | TechSpot
Unpatched flaw in OnePlus phones lets rogue apps text messages
Denial of Service/DoS/DDoS
Double the Power: New DDoS From 'Aisuru' Botnet Easily Shatters Record
Cloudflare mitigates largest-ever DDoS attack at 22.2 Tbps
ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Service
Tech Overtakes Gaming as Top DDoS Attack Target, New Gcore Radar Report Finds
Predicting DDoS attacks: How deep learning could give defenders an early warning - Help Net Security
Internet of Things – IoT
EV charging biz zaps customers with data leak scare • The Register
Hackers Exploiting Hikvision Camera Vulnerability to Access Sensitive Information
Data Breaches/Leaks
ChatGPT 'ShadowLeak' Allows Hackers to Steal Emails
‘Harvest Now, Decrypt Later’ Attacks in the Post-Quantum, AI Era - EE Times Europe
Car Giant Stellantis Confims Third-Party Breach - Infosecurity Magazine
The culture of silence on data breaches has gone too far - Tech Monitor
Vastaamo psychotherapy hack: US citizen charged in latest twist of notorious data breach
Stellantis Data Breach Affects Millions of Car Buyers: Report | Entrepreneur
Cybercriminals are going after law firms' sensitive client data - Help Net Security
EV charging biz zaps customers with data leak scare • The Register
Volvo Group Employee Data Stolen in Ransomware Attack - SecurityWeek
‘Our worst day’: The untold story of the Electoral Commission cyber attack | Computer Weekly
Children's names, pictures and addresses stolen in nursery hack - BBC News
Boyd Gaming discloses data breach after suffering a cyberattack
Organised Crime & Criminal Actors
UK chancellor blames cyberattacks on Russia despite evidence • The Register
Scattered Spider Member Surrenders Amid Shutdown Claims
Teen arrested in UK was a core figure in Scattered Spider’s operations | CyberScoop
Attacker Breakout Time Falls to 18 Minutes - Infosecurity Magazine
Inside the economy built on stolen credentials - Help Net Security
Eurojust Arrests 5 in €100M Cryptocurrency Investment Fraud Spanning 23 Countries
Canada dismantles TradeOgre exchange, seizes $40 million in crypto
$439 million recovered in global financial crime crackdown - Help Net Security
€100M crypto scam busted: Five arrested in Europe-wide operation - Help Net Security
‘I Was a Weird Kid’: Jailhouse Confessions of a Teen Hacker – DataBreaches.Net
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
€100M crypto scam busted: Five arrested in Europe-wide operation - Help Net Security
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
North Korean IT workers use fake profiles to steal crypto - Help Net Security
Canada dismantles TradeOgre exchange, seizes $40 million in crypto
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
Malware 'Game' On Steam Stole $32K From Cancer-Stricken Streamer
Insider Risk and Insider Threats
What to do if your company discovers a North Korean worker in its ranks | CyberScoop
How hiring fraud has become a cybersecurity threat vector | Biometric Update
US employees 'unprepared' for cybersecurity threats - New Study
Lazarus RAT code resurfaces in North Korean IT-worker scams • The Register
Insurance
Cyber attacks cost Europe €300bn in five years, warns Howden | Global Reinsurance
Cyber reinsurers reconsider appetite as market softens :: Insurance Day
Supply Chain and Third Parties
Threat actors turning to MFA bypass, USB malware and supply chain attacks | SC Media
Experts Warn of Global Breach Risk from Indian Suppliers - Infosecurity Magazine
Stellantis Data Breach Affects Millions of Car Buyers: Report | Entrepreneur
UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors
Airport Chaos Shows Human Impact of 3rd-Party Attacks
Jaguar Land Rover Extends Production Pause Again - Infosecurity Magazine
Airport cyber attacks highlight growing supply chain risk :: Insurance Day
Airport Chaos Shows Human Impact of 3rd-Party Attacks
Survey assesses impact of JLR cyber attack on supply chain - BBC News
Hackers target supply chains’ weak links in growing threat to companies
Tata-owned Jaguar Land Rover pushes to pay struggling suppliers after hack - The Economic Times
Software Supply Chain
5 ways to spot software supply chain attacks and stop worms - before it's too late | ZDNET
Encryption
‘Harvest Now, Decrypt Later’ Attacks in the Post-Quantum, AI Era - EE Times Europe
Linux and Open Source
BlackLock Ransomware Attacking Windows, Linux, and VMware ESXi Environments
Passwords, Credential Stuffing & Brute Force Attacks
How One Bad Password Ended a 158-Year-Old Business
Inside the economy built on stolen credentials - Help Net Security
The Credential Cracking Crisis: Why Role-Based Training Is No Longer Optional | MSSP Alert
Social Media
Trump says Michael Dell is part of the team buying TikTok • The Register
Regulations, Fines and Legislation
What Is Regulatory Compliance? | Definition From TechTarget
Will banning ransom payments help protect UK businesses? - Raconteur
Cyber threat information law hurtles toward expiration, with poor prospects for renewal | CyberScoop
Banks Brace for Cyber Fight as CISA Faces Expiration
FBI Pushes Back Against Scrutiny Over Cyber Cuts, Vacancies
NIS2 in the Baltics: How Lithuania, Latvia, and Estonia Differ
DoD issues replacement for risk management framework - Breaking Defense
Models, Frameworks and Standards
Has the UK’s Cyber Essentials scheme failed? - Tech Monitor
DoD issues replacement for risk management framework - Breaking Defense
NIS2 in the Baltics: How Lithuania, Latvia, and Estonia Differ
Careers, Working in Cyber and Information Security
Cyber Team Burnout Rivals Healthcare, Expert Says
AI is altering entry-level cyber hiring — and the nature of the skills gap | CSO Online
FBI to CISO: Unconventional Paths to Cyber Success
Law Enforcement Action and Take Downs
Teen arrested in UK was a core figure in Scattered Spider’s operations | CyberScoop
Was the chancellor right to accuse Russia of being behind recent UK cyber attacks? | ITV News
UK chancellor blames cyberattacks on Russia despite evidence • The Register
Scattered Spider Member Surrenders Amid Shutdown Claims
Vastaamo psychotherapy hack: US citizen charged in latest twist of notorious data breach
Suspect arrested in cyberattack on Collins Aerospace check-in software | SC Media
€100M crypto scam busted: Five arrested in Europe-wide operation - Help Net Security
Canada dismantles TradeOgre exchange, seizes $40 million in crypto
Eurojust Arrests 5 in €100M Cryptocurrency Investment Fraud Spanning 23 Countries
$439 million recovered in global financial crime crackdown - Help Net Security
Judge orders release of teen accused in 2023 casino cyberattacks – DataBreaches.Net
Another alleged Scattered Spider member arrested • The Register
Las Vegas police arrest minor accused of high-profile 2023 casino attacks | CyberScoop
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
UK needs better defences to protect undersea internet cables from Russian sabotage | Computer Weekly
New Chinese Espionage Hacking Group Uncovered
Suspected Chinese spies broke into 'numerous' enterprises • The Register
Nation State Actors
China
Suspected Chinese spies broke into 'numerous' enterprises • The Register
New Chinese Espionage Hacking Group Uncovered
‘Most Prevalent’ Chinese Hacking Group Targets Tech, Law Firms
Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike
Telecom exec: Salt Typhoon inspiring other hackers to use unconventional techniques | CyberScoop
SEO Poisoning Campaign Tied to Chinese Actor
Trump says Michael Dell is part of the team buying TikTok • The Register
Dropping China spying charges leaves Commons open to espionage, says Speaker - BBC News
Chinese Cyberspies Hacked US Defense Contractors - SecurityWeek
Russia
UK needs better defences to protect undersea internet cables from Russian sabotage | Computer Weekly
Was the chancellor right to accuse Russia of being behind recent UK cyber attacks? | ITV News
UK chancellor blames cyberattacks on Russia despite evidence • The Register
Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions - SecurityWeek
Russian State Hackers Collaborate in Attacks Against Ukraine - Infosecurity Magazine
Russia Targets Moldovan Election in Disinformation Play
Spanish military jet carrying defence minister hit with 'cyber attack' near Russia - JOE.co.uk
Researchers say media outlet targeting Moldova is a Russian cutout | CyberScoop
Iran
Nimbus Manticore Deploys New Malware Targeting Europe - Check Point Research
Iran-Linked Hackers Target Europe With New Malware
Iranian State APT Blitzes Telcos & Satellite Companies
Flushable wipes and Iran: Water treatment facility adds cyberattacks to worry list : NPR
North Korea
What to do if your company discovers a North Korean worker in its ranks | CyberScoop
How hiring fraud has become a cybersecurity threat vector | Biometric Update
Lazarus RAT code resurfaces in North Korean IT-worker scams • The Register
DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
North Korean IT workers use fake profiles to steal crypto - Help Net Security
Calls grow for cybersecurity control tower - The Korea Times
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Hate Groups Seize on Trump’s Antifa Order With Online Threats
Tools and Controls
AI is altering entry-level cyber hiring — and the nature of the skills gap | CSO Online
New EDR-Freeze tool uses Windows WER to suspend security software
Gartner: Preemptive cybersecurity to dominate 50% of security spend by 2030 - Help Net Security
Gartner: CISOs must master agentic AI and turn hype into strategy
Cyber Threat Detection Vendors Pull Out of MITRE Evaluations Test - Infosecurity Magazine
Lean Teams, Higher Stakes: Why CISOs Must Rethink Incident Remediation
5 ways to spot software supply chain attacks and stop worms - before it's too late | ZDNET
10 Common Network Vulnerabilities That Could Put Your Business At Risk - Security Boulevard
North Korean Hackers Use New AkdoorTea Backdoor to Target Global Crypto Developers
Predicting DDoS attacks: How deep learning could give defenders an early warning - Help Net Security
How AI augmentation is revolutionizing penetration testing in cybersecurity | TechRadar
Beware Falling Into the Technology-First Resilience Trap
Anything but safe: Using VPN can bear immense risks – DW – 09/20/2025
DoD issues replacement for risk management framework - Breaking Defense
Brit banking group insists security priority in AI rollout • The Register
Other News
UK needs better defences to protect undersea internet cables from Russian sabotage | Computer Weekly
Why hackers are targeting the world's shipping - BBC News
Cyber attacks impacting trust in online retail - survey
Three in four European companies are hooked on US tech • The Register
The diplomacy of emerging tech and cross–border data sharing
As Incidents Rise, Japan's Cybersecurity Falls Short
Retail at risk: How one alert uncovered a persistent cyberthreat | Microsoft Security Blog
Austria military ditches Microsoft for open-source LibreOffice - here's why | ZDNET
Avoiding service desk exploitation: deconstructing the modern retail attack | TechRadar
Vulnerability Management
Critical Security Flaws Grow with AI Use, New Report Shows - Infosecurity Magazine
10 Common Network Vulnerabilities That Could Put Your Business At Risk - Security Boulevard
How to get free Windows 10 security updates through October 2026 | ZDNET
Microsoft pressured to extend free Windows 10 security updates in most of Europe
Microsoft Accepts to Make Windows 10 Extended Security Updates Free for EU Consumers
Vulnerabilities
Azure Entra ID Flaw Highlights Microsoft IAM Issues
SolarWinds fixes critical Web Help Desk RCE vulnerability (CVE-2025-26399) - Help Net Security
Cisco Firewall Zero-Days Exploited in China-Linked ArcaneDoor Attacks - SecurityWeek
Urgent: Cisco ASA Zero-Day Duo Under Attack; CISA Triggers Emergency Mitigation Directive
Cisco's Wave of Zero-Day Bugs Targets Firewalls, IOS
Hacker Deploys 'OVERSTEP' Backdoor in SonicWall Attack
Microsoft Patches Critical Entra ID Flaw Enabling Global Admin Impersonation Across Tenants
SonicWall Updates SMA 100 Appliances to Remove Overstep Malware - SecurityWeek
Two New Supermicro BMC Bugs Allow Malicious Firmware to Evade Root of Trust Security
Microsoft finally squashed this major Windows 11 24H2 bug - one year later | ZDNET
Critical Vulnerability in Salesforce AgentForce Exposed - Infosecurity Magazine
Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection
Fortra Patches Critical GoAnywhere MFT Vulnerability - SecurityWeek
Final Chrome 140 update fixes more security vulnerabilities | PCWorld
Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials
Two Critical Flaws Uncovered in Wondershare RepairIt Exposing User Data and AI Models
Unpatched flaw in OnePlus phones lets rogue apps text messages
CISA says hackers breached federal agency using GeoServer exploit
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Links to external articles are provided for general interest and awareness only. Linking to or reposting external content does not constitute endorsement of or by any organisation, service, or product. We do not control and are not responsible for the content, security, or availability of external websites or links. Full credit is given to the original authors and sources. E&OE.
Black Arrow Cyber Threat Intelligence Briefing 19 September 2025
Black Arrow Cyber Threat Intelligence Briefing 19 September 2025:
-Jaguar Land Rover Extends Shutdown After Cyber Attack by Another Week
-Two Scattered Spider Teens Charged over Attack on London’s Transport Network
-Scattered Spider Resurfaces with Financial Sector Attacks Despite Retirement Claims
-It Doesn’t Take a Genius to Be a Cybercriminal, and Open Source Ransomware Is Making It Easier than Ever
-New Android Malware Steals Your Money Then Installs Ransomware
-Disrupted Phishing Service Was After Microsoft 365 Credentials
-AI Threats Top Focus at London Financial Services Summit
-Shadow AI Is Breaking Corporate Security from Within
-Global Hiring Risks: Identity Fraud and Screening Trends
-Cyber Skills Shortage Forces 64% of EMEA Organisations into Risky Security Shortcuts
-70% of Security Leaders Say Internal Misalignment Creates More Chaos Than Threat Actors
-The Secret Psychological Cost of Cyber Attacks
-Russia’s Hybrid Tactics Raise Alarm in EU
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week’s review highlights the growing complexity of cyber threats and the leadership response required.
Ransomware and phishing remain dominant, with major disruptions at Jaguar Land Rover and Transport for London. Criminal groups such as Scattered Spider are evolving, using AI-driven social engineering, while open-source ransomware and hybrid malware lower the barrier for attackers.
AI is both a defensive tool and a risk factor: financial services leaders warn of deepfake-enabled fraud, while unapproved AI use within organisations is driving compliance breaches and supply chain exposure. Internal weaknesses amplify these risks: research shows poor incident coordination and skills shortages create more disruption than attackers, while identity fraud in hiring and the psychological toll on staff add long-term challenges. Geopolitical tensions further complicate the landscape, with Russia escalating hybrid tactics across Europe.
Clear Board-level ownership and governance, a proactive investment in a security culture, and regular rehearsals of cyber incident management are essential to resilience. Contact us for impartial and objective leadership guidance on strengthening your organisation’s defences.
Top Cyber Stories of the Last Week
Jaguar Land Rover Extends Shutdown After Cyber Attack by Another Week
Jaguar Land Rover has extended its production shutdown for another week following a major cyber attack that disrupted its global operations. The company, which employs around 39,000 staff and generates annual revenue exceeding £29 billion, confirmed that attackers stole company data and forced a halt to manufacturing. A group of criminals linked to well-known extortion gangs has claimed responsibility, citing the use of stolen credentials and ransomware. JLR stated it is still investigating the incident and carefully planning a phased restart, underlining the severe operational and reputational risks posed by targeted cyber attacks on organisations.
Two Scattered Spider Teens Charged over Attack on London’s Transport Network
Two young men have been charged in connection with last year’s cyber attack on Transport for London, which disrupted services, exposed customer data, and cost the organisation tens of millions. Authorities allege the pair are linked to a wider criminal group and note that one also faces charges relating to US healthcare systems. The National Crime Agency stressed the attack demonstrated the serious risks posed to critical national infrastructure, highlighting the need for sustained disruption of such groups. Transport for London has since strengthened its security measures and continues to support the investigation.
https://www.theregister.com/2025/09/18/two_teens_charged_in_tfl_case/
Scattered Spider Resurfaces with Financial Sector Attacks Despite Retirement Claims
Scattered Spider, the cyber crime group linked with attacks including Jaguar Land Rover and retailer Marks and Spencer, and which recently claimed to have disbanded, has resurfaced with fresh attacks on the financial sector. Researchers report the group gained access by tricking an executive into resetting their password, then moved deeper into systems to steal sensitive data and bypass security controls. Evidence suggests overlap with other groups such as ShinyHunters, which are now exploiting artificial intelligence to run highly convincing voice scams at scale. The group’s apparent retirement may have been a smokescreen to evade law enforcement, and organisations are urged to remain vigilant as such actors often regroup under new identities.
https://thehackernews.com/2025/09/scattered-spider-resurfaces-with.html
It Doesn’t Take a Genius to Be a Cybercriminal, and Open Source Ransomware Is Making It Easier than Ever
A recent study has highlighted that open-source ransomware is lowering the barrier for criminals, enabling even those with limited technical ability to launch attacks. One group, named Yurei, successfully targeted a food manufacturer by slightly modifying an existing ransomware tool. Their approach combined data theft with encryption, demanding payment both to restore access and to prevent data being leaked or sold. Although flaws in the reused code allow for some recovery, the research found that low-effort attacks can still succeed. With around 80% of ransomware now using artificial intelligence, the risk to organisations continues to rise.
New Android Malware Steals Your Money Then Installs Ransomware
Security researchers have identified a new Android malware, named RatOn, that merges banking fraud with ransomware in a single attack. The malware can autonomously steal personal identification numbers, drain bank accounts and crypto wallets, then lock the device and demand payment to restore access. This evolution highlights how criminals are adapting to stronger banking security by combining multiple methods of extortion. Distribution often occurs through fake apps that mimic trusted platforms such as TikTok, underlining the need for vigilance when downloading apps and ensuring protective features like Google Play Protect remain enabled.
Disrupted Phishing Service Was After Microsoft 365 Credentials
Microsoft and Cloudflare have taken down a large-scale phishing service called RaccoonO365, which sold ready-made kits to steal Microsoft 365 login details. Since July 2024 the operation compromised at least 5,000 accounts across 94 countries, with criminals then able to access company files, emails, and cloud storage for fraud, extortion, or wider attacks. The service was sold for about $355 a month and could send up to 9,000 fraudulent emails daily. Authorities shut down 338 associated websites and arrested a key suspect, significantly disrupting the operation and raising costs for its criminal users.
AI Threats Top Focus at London Financial Services Summit
The London Financial Services Cyber Security Summit underlined that resilience has become a regulatory and strategic imperative for the sector. Senior leaders warned that artificial intelligence is being used both to strengthen defences and to fuel more sophisticated cyber attacks such as deepfake-enabled fraud. Insider threats and weak oversight of staff with financial authority remain a major risk. Regulators emphasised that compliance should be seen not only as a legal duty but also as a competitive advantage. Across the summit, the message was clear: collaboration, cultural change and proactive investment are critical to safeguarding long-term stability.
https://www.inforisktoday.com/ai-threats-top-focus-at-london-financial-services-summit-a-29474
Shadow AI Is Breaking Corporate Security from Within
The latest State of Information Security Report from IO shows that organisations face mounting risks from artificial intelligence, compliance demands, and supply chain vulnerabilities. Nearly eight in ten firms adopted AI last year, yet more than a third of employees are using tools without approval, raising the risk of data leaks and regulatory breaches. Data breaches and compliance pressures are prevalent, with 71% of firms fined in the past year and nearly a third paying penalties above £250,000. Meanwhile, 61% reported supply chain incidents, driving increased investment in oversight, although smaller suppliers remain a persistent weak link.
https://www.helpnetsecurity.com/2025/09/18/ai-attack-surface-risks/
Global Hiring Risks: Identity Fraud and Screening Trends
HireRight’s 2025 Global Benchmark Report highlights rising risks of identity fraud in hiring, with one in six companies reporting confirmed cases yet less than 80% including identity verification in their standard screening. Most organisations use the same approach regardless of whether the employee will work remotely, which is particularly significant given the prevalence of North Koreans infiltrating organisations as remote IT workers. Discrepancies in candidate histories remain common, with over three-quarters of businesses finding issues in the past year. These trends underline the need for closer collaboration between HR, compliance, and cyber security leaders to reduce fraud and reputational risks.
https://www.helpnetsecurity.com/2025/09/18/global-hiring-risks-2025/
Cyber Skills Shortage Forces 64% of EMEA Organisations into Risky Security Shortcuts
New research shows that 64% of organisations across Europe, the Middle East and Africa are forced to take risky shortcuts due to a shortage of cyber security skills. In the UK, two thirds of organisations report gaps, with more than half describing the impact as severe. Only a quarter of IT leaders believe they have the right expertise in-house, leading to delays in projects and difficulties meeting compliance rules. The shortage spans technical, operational and leadership roles, with high hiring costs and limited candidates deepening the challenge and creating both immediate and long-term risks to resilience and growth.
70% of Security Leaders Say Internal Misalignment Creates More Chaos Than Threat Actors
Cytactic’s 2025 report highlights that internal breakdowns, not external attackers, are the greatest barrier to effective cyber attack response. 70% of leaders said poor coordination created more disruption than the breach itself, with many citing unclear authority and strained CEO-CISO relations. Over half faced incidents they had never rehearsed, despite most recognising the value of simulations. Boards were also seen as underestimating the urgency of response. The report stresses the need for clearer leadership roles, better cross-team communication, and investment in AI and rehearsal exercises to strengthen resilience when breaches occur.
The Secret Psychological Cost of Cyber Attacks
Recent research shows that two in five UK small and medium businesses have lost money to fraud, with phishing being one of the most common forms of attack. While financial loss often takes the spotlight, the hidden impact on staff can be just as damaging. Employees caught in these scams may experience guilt, fear and a loss of confidence, which can harm both performance and wellbeing. A culture of blame makes matters worse by discouraging prompt reporting. By fostering openness, empathy and practical training, leaders can strengthen resilience and reduce both the financial and psychological cost of attacks.
Russia’s Hybrid Tactics Raise Alarm in EU
Russian hybrid tactics are escalating, combining cyber attacks, disinformation, and physical incursions, such as the recent drone violations of Polish airspace. In response, Poland has pressed for stronger air defence, increased allied presence, and tougher sanctions. The EU is supporting these efforts through its €150 billion SAFE programme, with €43.7 billion allocated to Poland for military strengthening. With large-scale Russian and Belarusian military exercises planned, Poland has temporarily closed its border with Belarus, warning of destabilisation attempts. Leaders stress that resilience, investment, and unity are vital to counter these threats and maintain regional security.
https://wbj.pl/russias-hybrid-tactics-raise-alarm-in-eu/post/147240
Governance, Risk and Compliance
The Evolving Role of the CISO: From Security Experts to Strategic Comm - Infosecurity Magazine
Cyber Resilience Confidence vs. Capability Gap: Are Organizations Prepared? | Dell
Geopolitics Reshapes Security Budgets in Financial Services
Security Execs Say Internal Mayhem Makes Cyber Attacks Worse
5 trends reshaping IT security strategies today | CSO Online
Cyber leaders must make better use of risk experts | Computer Weekly
The secret psychological cost of cyberattacks
Cyber professionals are losing sleep over late night attacks | IT Pro
Creating a compliance strategy that works across borders - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
Beware! New Android malware steals your money then installs ransomware | PCWorld
Scattered Spider hackers return to hit more victims - despite retirement claims | TechRadar
Did Scattered Spider Scatter? Cyber Experts Are Skeptical | Security Magazine
Scattered LAPSUS$ Hunters Announces Closure - GovInfoSecurity
What Are The Takeaways from The Scattered Lapsus $Hunters Statement?
HybridPetya ransomware dodges UEFI Secure Boot • The Register
Hackers behind Jaguar Land Rover announce their 'retirement' – should we believe them? | IT Pro
Open-Source Ransomware Tools on GitHub Fuel AI-Driven Cybercrime Surge
How ransomware is changing to target businesses in 2025 | IT Pro
Ransomware crims broke in, found recovery codes in plaintext • The Register
UK arrests 'Scattered Spider' teens linked to Transport for London hack
Ransomware TMZ: More Than a Year of Leaks, Lies and Betrayals | MSSP Alert
Ransomware Victims
Scattered Spider Resurfaces With Financial Sector Attacks Despite Retirement Claims
Scattered Spider gang feigns retirement, breaks into bank • The Register
Jaguar Land Rover suppliers 'face bankruptcy' due to hack crisis - BBC News
Cyber attack could be costing JLR £5 million a day | Autocar
JLR extends production shutdown to next week amid cyber attack chaos | TheBusinessDesk.com
JLR still unable to restart production as MPs call for government help | Autocar
JLR supply chain staff told to apply for universal credit, union says - BBC News
VC giant Insight Partners warns thousands after ransomware breach
ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks
FBI Issues Salesforce Instance Warning Over 'ShinyHunters' Data Theft | Salesforce Ben
UK arrests 'Scattered Spider' teens linked to Transport for London hack
INC ransom group claimed the breach of Panama’s Ministry of Economy and Finance
Tiffany Data Breach Impacts Thousands of Customers - SecurityWeek
UK telco Colt’s cyberattack recovery seeps into November • The Register
ShinyHunters Attack National Credit Information Center of Vietnam
KillSec Ransomware Hits Brazil's Healthcare Sector
Qilin ransomware gang claims attack on Orleans Parish Sheriff's Office
Survival Flight reports second cybersecurity incident in less than a year – DataBreaches.Net
Phishing & Email Based Attacks
Scary results as study shows AI chatbots excel at phishing tactics - Cryptopolitan
Disrupted phishing service was after Microsoft 365 credentials | Malwarebytes
Threat Actors Leverage Several RMM Tools in Phishing Attack to Maintain Remote Access
Attackers Up Their Game with Ultra-Realistic PDF Invoice Lures, HP Finds | WebWire
Beware Email Scams Seeking Feedback on the UK's Emergency Alerts Test - ISPreview UK
This North Korean Phishing Attack Used ChatGPT's Image Generation
Phishing campaign targets Rust developers - Help Net Security
RaccoonO365 Phishing Network Dismantled as Microsoft, Cloudflare Take Down 338 Domains
Other Social Engineering
Why You Should Never Scan A QR Code To Pay For Parking
Password1: how scammers exploit variations of your logins | Money | The Guardian
Cybercriminals Have a Weird New Way to Target You With Scam Texts | WIRED
Fraud, Scams and Financial Crime
Why You Should Never Scan A QR Code To Pay For Parking
Cybercriminals Have a Weird New Way to Target You With Scam Texts | WIRED
Google nukes 224 Android malware apps behind massive ad fraud campaign
AI made crypto scams far more dangerous - Help Net Security
Beware Email Scams Seeking Feedback on the UK's Emergency Alerts Test - ISPreview UK
AI-Powered Sign-up Fraud Is Scaling Fast
Cybersecurity in Ukraine: new fraud schemes and how to protect yourself | УНН
Google confirms fraudulent account created in law enforcement portal
Artificial Intelligence
Scary results as study shows AI chatbots excel at phishing tactics - Cryptopolitan
Shadow AI is breaking corporate security from within - Help Net Security
AI Threats Top Focus at London Financial Services Summit
AI made crypto scams far more dangerous - Help Net Security
AI-Powered Sign-up Fraud Is Scaling Fast
Open-Source Ransomware Tools on GitHub Fuel AI-Driven Cybercrime Surge
5 trends reshaping IT security strategies today | CSO Online
Hacker Exploits Claude AI to Automate Cyberattacks on 17 Companies
Rising DNS Cyber Attacks: AI-Driven Threats Demand Zero-Trust Defenses
Most enterprise AI use is invisible to security teams - Help Net Security
AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns
Democratizing AI: Balancing Innovation, Risks in ChatGPT Era
Opinion | AI and drone warfare is here. The U.S. isn’t ready. - The Washington Post
A Quarter of UK and US Firms Suffer Data Poisoning Attacks - Infosecurity Magazine
This North Korean Phishing Attack Used ChatGPT's Image Generation
AI-Forged Military IDs Used in North Korean Phishing Attack - Infosecurity Magazine
New attack on ChatGPT research agent pilfers secrets from Gmail inboxes - Ars Technica
LinkedIn now uses your data for AI by default, opt out now! - Help Net Security
How CISOs Can Drive Effective AI Governance
AI video surveillance could end privacy as we know it - Help Net Security
Cloudflare CEO’s 'Frighteningly Likely' Forecast for How AI Will Ruin the Internet
Malware
CrowdStrike Infested With "Self-Replicating Worms"
Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack
Old file types, new tricks: Attackers turn everyday files into weapons - Help Net Security
Attackers Adopting Novel LOTL Techniques to Evade Detection - Infosecurity Magazine
The unseen side of malware and how to find it - Help Net Security
HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks
China-linked Mustang Panda deploys advanced SnakeDisk USB worm
Linux Security Tools Bypassed by io_uring Rootkit Technique, ARMO Research Reveals - InfoQ
HybridPetya: A Petya/NotPetya copycat comes with a twist
SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers
CountLoader Broadens Russian Ransomware Operations With Multi-Version Malware Loader
Bitdefender discovers China-linked malware - APDR
SEO Poisoning Targets Chinese Users with Fake Software Sites - Infosecurity Magazine
Sophisticated Cyber Campaign Deploys RATs via SEO-Poisoned GitHub Sites
Threat Actor Infests Hotels With New RAT - SecurityWeek
Mobile
Beware! New Android malware steals your money then installs ransomware | PCWorld
Cybercriminals Have a Weird New Way to Target You With Scam Texts | WIRED
Google nukes 224 Android malware apps behind massive ad fraud campaign
Google has made a huge change to the monthly Android Security Bulletin - PhoneArena
Apple backports zero-day patches to older iPhones and iPads
Google may shift to risk-based Android security patch rollouts - what that means for you | ZDNET
1 in 3 Android Apps Leak Sensitive Data - Infosecurity Magazine
Samsung patches actively exploited zero-day reported by WhatsApp
Make Sure Your Android Phone Has This Security Feature Enabled (And Here's Why)
CERT-FR: Take Apple spyware alerts seriously | Cybernews
Denial of Service/DoS/DDoS
Cloudflare DDoSed itself with React useEffect hook blunder • The Register
Internet of Things – IoT
Dutch University Washing Machines Hacked, Disrupting Laundry for 1,200 Students
Smart Home Security Tips to Prevent Hacking
Data Breaches/Leaks
ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks
FBI Issues Salesforce Instance Warning Over 'ShinyHunters' Data Theft | Salesforce Ben
SonicWall Discloses Compromise of Cloud Backup Service - Infosecurity Magazine
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations | CyberScoop
SonicWall warns customers to reset credentials after breach
1 in 3 Android Apps Leak Sensitive Data - Infosecurity Magazine
British rail passengers urged to stay on guard after hack signals failure
Tiffany Data Breach Impacts Thousands of Customers - SecurityWeek
Gucci, Balenciaga and Alexander McQueen targeted in cyber-attack
Hackers steal millions of Gucci, Balenciaga, and Alexander McQueen customer records
Millions of HNW clients at risk as Gucci hacked | Insurance Business America
Insider breach at FinWise Bank exposes data of 689,000 AFF customers
Cybercriminals pwn 850k+ Americans' healthcare data • The Register
New York Blood Center Alerts 194,000 People to Data Breach - Infosecurity Magazine
Vietnam data breach: whole population exposed | Cybernews
2 Eye Care Practice Hacks Affect 260,000 Patients, Staff
Bracknell and Wokingham college hit with cyber attack | Bracknell News
Organised Crime & Criminal Actors
Cyber professionals are losing sleep over late night attacks | IT Pro
Cybercriminals Evolve Tactics: New HP Report Reveals Sophisticated Threats
Open-Source Ransomware Tools on GitHub Fuel AI-Driven Cybercrime Surge
Cyber-scam camp operators shifting to vulnerable countries • The Register
DOJ Resentences BreachForums Founder to 3 Years for Cybercrime and Possession of CSAM
NCA Singles Out “The Com” as it Chairs Five Eyes Group - Infosecurity Magazine
The Feds Destroyed an Internet Weapon, but Criminals Picked Up the Pieces - WSJ
15 ransomware gangs ‘go dark’ to enjoy 'golden parachutes' • The Register
"Pompompurin" resentenced: BreachForums creator heads back behind bars
Fifteen Ransomware Gangs “Retire,” Future Unclear - Infosecurity Magazine
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
AI made crypto scams far more dangerous - Help Net Security
Insider Risk and Insider Threats
The secret psychological cost of cyberattacks
Insider breach at FinWise Bank exposes data of 689,000 AFF customers
Engineer Who Tried To Pass Secrets To Russia Gets 10½ Years - Law360
Supply Chain and Third Parties
CrowdStrike Infested With "Self-Replicating Worms"
Self-Replicating Worm Hits 180+ npm Packages to Steal Credentials in Latest Supply Chain Attack
New supply chain attack hits npm registry, compromising 40+ packages
Mitigating supply chain vulnerabilities | TechRadar
Cloud/SaaS
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations | CyberScoop
Disrupted phishing service was after Microsoft 365 credentials | Malwarebytes
Microsoft scores win against Office 365 credential thieves | Computer Weekly
The Cloud Edge Is the New Attack Surface
The unseen risk in Microsoft 365: disaster recovery | IT Pro
Target-rich environment: Why Microsoft 365 has become the biggest risk
Outages
Starlink outage knocks tens of thousands offline worldwide • The Register
Linux and Open Source
Linux Security Tools Bypassed by io_uring Rootkit Technique, ARMO Research Reveals - InfoQ
UEFI Secure Boot for Linux Arm64 – where do we stand? • The Register
Passwords, Credential Stuffing & Brute Force Attacks
Disrupted phishing service was after Microsoft 365 credentials | Malwarebytes
Microsoft scores win against Office 365 credential thieves | Computer Weekly
SonicWall Discloses Compromise of Cloud Backup Service - Infosecurity Magazine
SonicWall warns customers to reset credentials after breach
Password1: how scammers exploit variations of your logins | Money | The Guardian
Social Media
TikTok Deal Won't End Enterprise Risks
Facebook's settlement payments are on the way - here's how much you can expect | ZDNET
LinkedIn now uses your data for AI by default, opt out now! - Help Net Security
Australia to let Big Tech choose kids social media ban tech • The Register
Regulations, Fines and Legislation
EU’s NIS2 directive brings tougher cybersecurity rules - The Recycler
UK ministers probe 'child-protection' Online Safety tweaks • The Register
China: 1-hour deadline on serious cyber incident reporting • The Register
Creating a compliance strategy that works across borders - Help Net Security
A Deeper Dive: The SEC Cybersecurity Rule Enforcement Landscape | BakerHostetler - JDSupra
Australia to let Big Tech choose kids social media ban tech • The Register
The CMMC Rule is Here: What Contractors Need to Know | Akin Gump Strauss Hauer & Feld LLP - JDSupra
CISA misspent millions in cyber skill retention funds: audit • The Register
CISA attempts to assert control over CVE in vision outline • The Register
Without Federal Help, Cyber Defense Is Up to Us
The Next Cyber Breach Will Not Wait: Why Congress Must Reauthorize CISA 2015
CISA blasted by US watchdog for wasting funds and retaining the wrong employees | TechRadar
The Quality Era: How CISA’s Roadmap Reflects Urgency for Modern Cybersecurity - Security Boulevard
Agencies increasingly dive into AI for cyber defense, acting federal CISO says | CyberScoop
Models, Frameworks and Standards
EU’s NIS2 directive brings tougher cybersecurity rules - The Recycler
NCSC updates Cyber Assessment Framework (2) | UKAuthority
The CMMC Rule is Here: What Contractors Need to Know | Akin Gump Strauss Hauer & Feld LLP - JDSupra
Careers, Working in Cyber and Information Security
Cyber Skills Shortage Forces 64% of EMEA Organisations into Risky Security Shortcuts
Organisations still struggling to close cybersecurity skills gap
Cybersecurity: The job that comes with a daily dose of ‘impending doom’
Cyber hiring trends | Professional Security Magazine
Microsoft Principal Security Engineer on How to Get Into Cybersecurity - Business Insider
Law Enforcement Action and Take Downs
DOJ Resentences BreachForums Founder to 3 Years for Cybercrime and Possession of CSAM
NCA Singles Out “The Com” as it Chairs Five Eyes Group - Infosecurity Magazine
Hackers behind Jaguar Land Rover announce their 'retirement' – should we believe them? | IT Pro
"Pompompurin" resentenced: BreachForums creator heads back behind bars
Engineer Who Tried To Pass Secrets To Russia Gets 10½ Years - Law360
Man gets over 4 years in prison for selling unreleased movies
RaccoonO365 Phishing Network Dismantled as Microsoft, Cloudflare Take Down 338 Domains
Misinformation, Disinformation and Propaganda
Opinion | AI and drone warfare is here. The U.S. isn’t ready. - The Washington Post
Russian fake-news network back in action with 200+ new sites • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Russia’s Hybrid Tactics Raise Alarm in EU
Opinion | AI and drone warfare is here. The U.S. isn’t ready. - The Washington Post
Geopolitics Reshapes Security Budgets in Financial Services
Bitdefender discovers China-linked malware - APDR
Nation State Actors
Opinion | AI and drone warfare is here. The U.S. isn’t ready. - The Washington Post
Geopolitics Reshapes Security Budgets in Financial Services
China
China-linked APT41 targets government, think tanks, and academics tied to US-China trade and policy
China: 1-hour deadline on serious cyber incident reporting • The Register
HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks
China-linked Mustang Panda deploys advanced SnakeDisk USB worm
TikTok Deal Won't End Enterprise Risks
Chinese cyber skirmishes in the Indo-Pacific show emerging patterns of conflict | The Strategist
Bitdefender discovers China-linked malware - APDR
SEO Poisoning Targets Chinese Users with Fake Software Sites - Infosecurity Magazine
Sophisticated Cyber Campaign Deploys RATs via SEO-Poisoned GitHub Sites
Costs of Russian, Chinese cyberattacks on German firms on rise: report
Russia
Russia’s Hybrid Tactics Raise Alarm in EU
Opinion | AI and drone warfare is here. The U.S. isn’t ready. - The Washington Post
MI6 launches dark web portal to attract spies in Russia - BBC News
Researchers believe Gamaredon and Turla threat groups are collaborating - Help Net Security
Russian fake-news network back in action with 200+ new sites • The Register
Ukrainian Cyberattack Paralyzes Russia’s Sham Election in Occupied Crimea
Engineer Who Tried To Pass Secrets To Russia Gets 10½ Years - Law360
CountLoader Broadens Russian Ransomware Operations With Multi-Version Malware Loader
Russian regional airline disrupted by suspected cyberattack | The Record from Recorded Future News
Iran
What's Old Is New Again as Iranian Hackers Exploit Macros
North Korea
This North Korean Phishing Attack Used ChatGPT's Image Generation
AI-Forged Military IDs Used in North Korean Phishing Attack - Infosecurity Magazine
Proton Mail Suspended Journalist Accounts at Request of Cybersecurity Agency
Tools and Controls
Geopolitics Reshapes Security Budgets in Financial Services
SonicWall Discloses Compromise of Cloud Backup Service - Infosecurity Magazine
Attack on SonicWall’s cloud portal exposes customers’ firewall configurations | CyberScoop
The Cloud Edge Is the New Attack Surface
The unseen risk in Microsoft 365: disaster recovery | IT Pro
Rising DNS Cyber Attacks: AI-Driven Threats Demand Zero-Trust Defenses
AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns
Threat Actors Leverage Several RMM Tools in Phishing Attack to Maintain Remote Access
Security Execs Say Internal Mayhem Makes Cyber Attacks Worse
Cyber leaders must make better use of risk experts | Computer Weekly
Zero Trust Is 15 Years Old — Why Full Adoption Is Worth the Struggle - SecurityWeek
CISOs grapple with the realities of applying AI to security functions | CSO Online
Many networking devices are still vulnerable to pixie dust attack - Help Net Security
Elon Musk Urges Heightened Security After Charlie Kirk Assassination
SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers
Phishing campaign targets Rust developers - Help Net Security
3 reasons VPN use is set to explode worldwide - and that might apply to you | ZDNET
More tools lead to greater risk of security issues and burnout - BetaNews
Digital twins give cyber defenders a predictive edge - SiliconANGLE
UEFI Secure Boot for Linux Arm64 – where do we stand? • The Register
How CISOs Can Drive Effective AI Governance
What is Mobile Threat Defense (MTD)? | Definition from TechTarget
Other News
3 reasons VPN use is set to explode worldwide - and that might apply to you | ZDNET
Europe needs to wake up to its internet network vulnerability
Kids hacking for kicks are causing security headaches at schools | IT Pro
Cyber resilience must be engineered into the UK’s infrastructure future | New Civil Engineer
Vulnerability Management
Google has made a huge change to the monthly Android Security Bulletin - PhoneArena
Microsoft reminds of Windows 10 support ending in 30 days
Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm - SecurityWeek
Microsoft: Exchange 2016 and 2019 reach end of support in 30 days
Microsoft Warns 200 Million Windows Users—Do Not Update Your PC
Consumer Reports calls Microsoft 'hypocritical' for stranding millions of Windows 10 PCs | ZDNET
CISA attempts to assert control over CVE in vision outline • The Register
Exploring Open Source and Compliance in Vulnerability Management - Security Boulevard
Vulnerabilities
Google patches another worrying Chrome security flaw - so update now, or be at risk | TechRadar
Many networking devices are still vulnerable to pixie dust attack - Help Net Security
Apple backports zero-day patches to older iPhones and iPads
Ransomware crims broke in, found recovery codes in plaintext • The Register
Cisco fixes high-severity IOS XR flaws enabling image bypass and DoS
Phoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 Seconds
Google Patches Chrome Zero-Day CVE-2025-10585 as Active V8 Exploit Threatens Millions
Update your Samsung phone ASAP to patch this zero-day flaw exploited in the wild | ZDNET
CISA Warns of Two Malware Strains Exploiting Ivanti EPMM CVE-2025-4427 and CVE-2025-4428
Samsung patches actively exploited zero-day reported by WhatsApp
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 12 September 2025
Black Arrow Cyber Threat Intelligence Briefing 12 September 2025:
-Qantas Penalises Executives for July Cyber Attack
-Three Critical Facts About Cyber Risk Management
-Pressure on CISOs to Stay Silent About Security Incidents Growing
-Why Security Teams Are Turning to the Dark Web to Protect Executives
-You Should Be Aware of These Latest Social Engineering Trends
-Insider Breaches Are a Bigger Security Threat than Ever Before. Here’s How Your Business Can Stay Safe
-Are Cybercriminals Hacking Your Systems or Just Logging in?
-New Automated Extortion Software Is So Devious You Won't Believe It
-Phishing Kit Unveils New Level of Sophistication
-New Malware Campaigns Highlight Rising AI and Phishing Risks
-Ransomware Kits Built with AI Are Behind a 70% Surge in Attacks
-Ransomware Losses Climb as AI Pushes Phishing to New Heights
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week’s review highlights the growing personal and organisational consequences of cyber attacks. Qantas cut executive bonuses after a major breach, reflecting increased leadership accountability. CISOs report pressure to conceal incidents, despite legal obligations. Boards are urged to adopt risk-based approaches that prioritise critical exposures.
Threats increasingly target individuals, with executives impersonated using AI and insider breaches causing costly damage. Phishing and ransomware attacks are becoming more sophisticated, using AI, mimicking multi-factor authentication and automating extortion.
These developments reinforce the need for stronger governance, clear accountability and a culture of security awareness. Contact us for guidance on how to achieve this in your organisation.
Top Cyber Stories of the Last Week
Qantas Penalises Executives for July Cyber Attack
Qantas has penalised its executive team by reducing annual bonuses by 15% after a July cyber attack exposed data belonging to 5.7 million people. The airline, which reported a profit of $1.5 billion, confirmed the breach did not involve credit card or passport data but did affect customer details such as names, emails and frequent flyer numbers, with some records also including addresses or dates of birth. The company has updated its risk management framework in response, stressing lessons learned and shared accountability among senior leaders. A forensic investigation into the incident remains ongoing.
https://therecord.media/qantas-airline-reduces-bonuses-executives-data-breach
Three Critical Facts About Cyber Risk Management
Organisations are being urged to shift from reactive cyber security to proactive risk management, as breaches continue to rise and cause severe business impact. A recent study highlighted three critical practices. First, firms must view their digital footprint the way attackers do, since exposure goes beyond what is listed in internal systems. Second, with limited resources, not every vulnerability can be fixed, so leaders must focus on the risks that matter most by weighing likelihood against impact. Finally, adopting proactive measures, supported by automation and AI, allows organisations to anticipate threats and reduce response times significantly.
https://www.trendmicro.com/en_us/research/25/i/cyber-risk-management-facts.html
Pressure on CISOs to Stay Silent About Security Incidents Growing
A recent survey has revealed that 69% of Chief Information Security Officers (CISOs) have been pressured by their employers to keep security incidents quiet, compared with 42% two years ago. This rise reflects growing tensions between regulatory obligations and corporate concerns about reputation. Experts note that attackers now often steal data quietly rather than disrupt operations, making breaches less visible but still serious. Regulators, including those enforcing GDPR and DORA, require timely disclosure, yet many CISOs report pressure to downplay or conceal incidents. Failure to disclose risks heavy penalties, loss of trust, and personal liability for senior leaders.
Why Security Teams Are Turning to the Dark Web to Protect Executives
A recent study found that nearly three quarters of US executives have been directly targeted by cyber criminals, with attacks against leaders continuing to rise. The dark web has become a marketplace where stolen credentials and personal details of corporate leaders are traded, enabling criminals to infiltrate company networks, commit fraud, or even endanger executives’ physical safety. Experts warn that once this information is leaked it cannot be removed, making prevention and monitoring critical. Organisations are being urged to strengthen access controls, improve executive cyber awareness, and integrate physical and cyber security measures into their protection plans.
You Should Be Aware of These Latest Social Engineering Trends
Social engineering attacks are becoming increasingly sophisticated as criminals exploit human behaviour rather than technical flaws. A recent case saw an asset management firm lose one million euros after an executive was deceived by AI-cloned voices and a fake contract. Tactics now include overwhelming victims with thousands of emails, impersonating IT helpdesks, and using legitimate tools like Microsoft Teams and Quick Assist to gain access. These methods highlight that people remain the weakest link in security. Firms are advised to strengthen access controls, limit external communications, and invest in employee awareness to reduce exposure.
Insider Breaches Are a Bigger Security Threat than Ever Before. Here’s How Your Business Can Stay Safe
New research shows insider threats, whether from careless mistakes or disgruntled employees, are now seen as a risk comparable to external cyber attacks. Nearly two thirds of organisations reported data breaches linked to insiders in the past two years, with average costs of $2.7 million. Almost half ranked data leakage from insiders as their top concern, yet only 27% use tools such as Data Loss Prevention to help manage this risk. Experts stress that while such tools are useful, businesses need layered defences and stronger oversight of how sensitive files are accessed, shared, and stored.
Are Cybercriminals Hacking Your Systems or Just Logging in?
Verizon reports that stolen passwords and login details were used in nearly a third of all data breaches last year, with more than 3.2 billion credentials stolen globally, a 33% rise on the previous year. Criminals are bypassing security controls by logging in as legitimate users, often using stolen passwords, session tokens or multi factor authentication codes. This approach has already fuelled major cyber attacks such as those against Change Healthcare and Snowflake. Organisations are urged to strengthen password protection, adopt zero trust principles, train staff against scams, and monitor for suspicious activity.
https://www.welivesecurity.com/en/business-security/cybercriminals-hacking-systems-logging-in/
New Automated Extortion Software Is So Devious You Won't Believe It
Researchers have warned of a new form of malware, known as Stealerium, that takes sextortion scams to a new level. The tool can capture login details, financial data and private messages, but more alarmingly it can detect when users access adult material, take a screenshot and activate the webcam to photograph them. Criminals are distributing it through fake emails posing as charities or banks, and it has already been seen in tens of thousands of cases. Victims are often in sectors such as hospitality, education and finance, making individuals rather than companies the main targets.
https://futurism.com/automated-extortion-software-devious
Phishing Kit Unveils New Level of Sophistication
Researchers have uncovered a new phishing campaign using the Salty2FA kit, which highlights how cyber crime operations are becoming increasingly professional. The campaign uses trusted platforms, company-branded login pages and advanced tools to bypass security controls, making attacks harder to spot and investigate. Targeted sectors include healthcare, finance, energy and technology. Crucially, the attackers even mimic multi factor authentication, reducing the effectiveness of traditional safeguards. This shows that phishing has evolved beyond basic scams, requiring organisations to update defences and strengthen staff awareness to guard against increasingly convincing cyber attacks.
https://www.infosecurity-magazine.com/news/salty2fa-phishing-kit/
New Malware Campaigns Highlight Rising AI and Phishing Risks
Researchers have uncovered new phishing campaigns that show how attackers are combining advanced malware with social engineering to bypass security. One campaign uses fake business emails to deliver MostereRAT, a tool that can take full control of a victim’s computer, disable built-in protections, and install remote access software. Another campaign uses fake download sites and “fix” prompts to trick users into installing data stealing software. In parallel, attackers are experimenting with ways to manipulate AI-powered tools, using hidden instructions to insert malicious steps into automated summaries, highlighting the growing overlap between AI risks and cyber crime.
https://thehackernews.com/2025/09/from-mostererat-to-clickfix-new-malware.html
Ransomware Kits Built with AI Are Behind a 70% Surge in Attacks
A new report warns that ransomware attacks rose by 70% in the first half of 2025, fuelled by criminals using artificial intelligence to scale operations. Attackers are packaging phishing emails, extortion notes and other pressure tactics into ready-made kits that can be sold and reused, making attacks easier to launch. While cryptocurrency remains the preferred payment method, total ransom payments fell by 35% in 2024 due to stronger law enforcement action and sanctions. The findings highlight how AI is shifting ransomware from purely technical exploits to broader campaigns targeting human behaviour.
https://crypto.news/ransomware-kits-built-with-ai-are-behind-a-70-surge-in-attacks/
Ransomware Losses Climb as AI Pushes Phishing to New Heights
Resilience’s 2025 midyear report highlights a sharp rise in ransomware and phishing attacks, both increasingly driven by artificial intelligence. Vendor-related risks have declined from 22% to 15% of losses, but remain costly when they occur. Ransomware insurance claims rose by 17% year on year, with criminals moving to triple extortion, adding threats of data leaks and service disruption to increase pressure. Phishing has become the most common entry point, now responsible for 42% of claims and nearly 9 in 10 of total losses. AI has made these attacks more convincing, with synthetic voice and other tools boosting success rates.
https://www.securityweek.com/ransomware-losses-climb-as-ai-pushes-phishing-to-new-heights/
Governance, Risk and Compliance
Pressure on CISOs to stay silent about security incidents growing | CSO Online
Why security teams are turning to the dark web to protect executives - Digital Journal
71% of CISOs hit with third-party security incident this year | CSO Online
6 hot cybersecurity trends | CSO Online
Lack of visibility creates "cascade" of security risk, says Kiteworks | IT Pro
Three Critical Facts About Cyber Risk Management | Trend Micro (US)
CISOs, stop chasing vulnerabilities and start managing human risk - Help Net Security
Mitigating supply chain vulnerabilities | TechRadar
What’s Your Cybersecurity Maturity? | Trend Micro (US)
CISOs Master Persuasion to Secure Cybersecurity Funding with Data and AI
How Leading CISOs are Getting Budget Approval
Creating a cyber-first culture through strategic governance | TechRadar
Threats
Ransomware, Extortion and Destructive Attacks
Remote Access Abuse Biggest Pre-Ransomware Indicator - Infosecurity Magazine
Report: Ransomware Attacks Costlier as Threat Actors Become More Systemic
Ransomware kits built with AI are behind a 70% surge in attacks
Ransomware, vendor outages, and AI attacks are hitting harder in 2025 - Help Net Security
New Automated Extortion Software Is So Devious You Won't Believe It
Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed | Trend Micro (US)
Akira ransomware crims abusing trifecta of SonicWall flaws • The Register
The crazy, true story behind the first AI-powered ransomware • The Register
Ransomware attacks fewer but costlier - report | Insurance Business America
Most pandemic-era ransomware raids conducted by two gangs - iTnews
Ransomware Victims
Jaguar Land Rover in 'truly horrible position' following cyber attack - CoventryLive
Concerns over impact of JLR cyber attack - BBC News
LunaLock Ransomware threatens victims by feeding stolen data to AI models
DZ Bank’s subsidiary says hackers lied about stolen data | Cybernews
Jaguar Land Rover Admits Data Breach Caused by Recent Cyberattack - SecurityWeek
Tata Motors shares in focus after JLR faces cybersecurity breach - The Economic Times
JLR Got Hacked So Bad They’re Still Registering Cars With Pen And Paper | Carscoops
Car part supplier's fears over Jaguar Land Rover cyber-attack - BBC News
M&S tech chief leaves months after cyber attack cost it £300m | Money News | Sky News
Ransomware attack at blood center: Org tells users their data's been stolen | Malwarebytes
Lovesac warns customers their data was breached after suspected RansomHub attack six months ago
100,000 Impacted by Cornwell Quality Tools Data Breach - SecurityWeek
Panama Ministry of Economy discloses breach claimed by INC ransomware
Phishing & Email Based Attacks
Salty2FA Phishing Kit Unveils New Level of Sophistication - Infosecurity Magazine
Emerging Phishing Threats: MostereRAT, ClickFix, and State-Sponsored Risks
From MostereRAT to ClickFix: New Malware Campaigns Highlight Rising AI and Phishing Risks
Critical 0-Click Vulnerability Enables Attackers to Takeover Email Access Using Punycode
You Didn't Get Phished — You Onboarded the Attacker
iCloud Calendar abused to send phishing emails from Apple’s servers
AI-Powered Phishing Attack Targets Microsoft 365 Accounts, Experts Warn | Ubergizmo
Noisy Bear Targets Kazakhstan Energy Sector With BarrelFire Phishing Campaign
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Jeremy Clarkson reveals hackers stole £27,000 from his Cotswolds pub | The Standard
Other Social Engineering
You Didn't Get Phished — You Onboarded the Attacker
Ransomware, vendor outages, and AI attacks are hitting harder in 2025 - Help Net Security
New Automated Extortion Software Is So Devious You Won't Believe It
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency | Reuters
You should be aware of these latest social engineering trends | CSO Online
Salesloft Drift Cyberattack Ups Social Engineering Attack Concerns
What is SIM-swapping fraud and what are the signs? - BBC News
Fake employers from North Korea hack hundreds | Cybernews
Beware the QR code: How a new scam is costing consumers £10,000 per day | The Independent
Fraud, Scams and Financial Crime
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency | Reuters
Fake employers from North Korea hack hundreds | Cybernews
US sanctions companies and individuals behind Southeast Asian scam centers | Crime News | Al Jazeera
Working with partners to tackle cyber crime and fraud - GOV.UK
Artificial Intelligence
Ransomware, vendor outages, and AI attacks are hitting harder in 2025 - Help Net Security
Ransomware kits built with AI are behind a 70% surge in attacks
LunaLock Ransomware threatens victims by feeding stolen data to AI models
Employees keep feeding AI tools secrets they can't take back - Help Net Security
How AI Puts Company Data at Risk | Kiplinger
AI agents are here, now comes the hard part for CISOs - Help Net Security
CISOs brace for a new kind of AI chaos - Help Net Security
AI-Powered Phishing Attack Targets Microsoft 365 Accounts, Experts Warn | Ubergizmo
AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack
Securing AI Models Against Adversarial Attacks in Financial Applications - Security Boulevard
Stealthy attack serves poisoned web pages only to AI agents - Help Net Security
Threat Actor Accidentally Exposes AI-Powered Operations - Infosecurity Magazine
Identity management was hard, AI made it harder - Help Net Security
Deepfakes are rewriting the rules of geopolitics - Help Net Security
AI is everywhere, but scaling it is another story - Help Net Security
The crazy, true story behind the first AI-powered ransomware • The Register
Anthropic Bans Chinese Entities from Claude AI Over Security Risks
2FA/MFA
Salty2FA Phishing Kit Unveils New Level of Sophistication - Infosecurity Magazine
6 ways to identify fake 2FA prompts and protect your accounts
Azure mandatory multifactor authentication: Phase 2 starting in October 2025 | Microsoft Azure Blog
Malware
macOS Stealer Campaign Uses “Cracked” App Lures to Bypass Apple Securi - Infosecurity Magazine
Secretive MaaS Group Spreads Novel 'CastleRAT'
Malicious npm Packages Steal Ethereum Keys in Typosquatting Attack
Atomic Stealer Disguised as Cracked Software Attacking macOS Users
'MostereRAT' Blends In, Blocks Security Tools
AsyncRAT Exploits ConnectWise ScreenConnect to Steal Credentials and Crypto
Hackers left empty-handed after massive NPM supply-chain attack
Vidar Infostealer Back With a Vengeance
Fileless Malware Deploys Advanced RAT via Legitimate Tools - Infosecurity Magazine
AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack
20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack
Russian Threat Group Targets Microsoft Outlook With Malware | Security Magazine
Chinese APT Actor Compromises Military Firm with Novel Fileless Malware - Infosecurity Magazine
Bots/Botnets
Exposed Docker APIs Likely Exploited to Build Botnet - SecurityWeek
Mobile
New Android RAT uses Near Field Communication to automatically steal money from devices | TechRadar
What is SIM-swapping fraud and what are the signs? - BBC News
New RatOn Android Malware Targets Banking Apps and Crypto Wallets via NFC Attacks
Apple Warns Of Series Mercenary Spyware Attacks Targeting Users Devices
Is WhatsApp Still Safe? Security Experts Weigh In After Zero-Day - ClearanceJobs
Ex-WhatsApp security boss sues Meta, alleging it ignored privacy flaws - The Washington Post
Is your phone actually listening in on you? The answer is complicated
Russia targets WhatsApp and pushes new 'super-app' as internet blackouts grow - BBC News
Traveling soon? 5 simple ways I thwart phone thieves - and you can too | ZDNET
Apple’s new Memory Integrity Enforcement system deals a huge blow to spyware developers | CyberScoop
Denial of Service/DoS/DDoS
Internet of Things – IoT
How Has IoT Security Changed Over the Past 5 Years?
70% of smart home devices vulnerable to cyberattacks: Cyber Security Council
Connected cars are racing ahead, but security is stuck in neutral - Help Net Security
7 Vulnerable IoT Devices: Hacking Risks and Security Tips
Data Breaches/Leaks
Qantas penalizes executives for July cyberattack | The Record from Recorded Future News
61% of US Companies Hit by Insider Data Breaches - Infosecurity Magazine
Salesloft Drift Cyberattack Ups Social Engineering Attack Concerns
More Cybersecurity Firms Hit by Salesforce-Salesloft Drift Breach - SecurityWeek
Salesloft GitHub Account Compromised Months Before Salesforce Attack - SecurityWeek
Financial services firm Wealthsimple discloses data breach
Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack
Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack - SecurityWeek
Qualys Confirms Data Breach - Hackers Accessed Salesforce Data in Supply Chain Attack
Tenable Confirms Data Breach - Hackers Accessed Customers Contact Details
France: Three Regional Healthcare Agencies Targeted by Cyber-Attacks - Infosecurity Magazine
VC giant Insight Partners notifies staff and limited partners after data breach | TechCrunch
Pentagon left livestream keys exposed, hijack risk included • The Register
Call audio from gym members, employees in open database • The Register
Everything we know about the Plex data breach so far | IT Pro
Irish League of Credit Unions is 'enhancing cybersecurity' after attack
100,000 Impacted by Cornwell Quality Tools Data Breach - SecurityWeek
Panama Ministry of Economy discloses breach claimed by INC ransomware
Plex tells users to reset passwords after new data breach
PSNI 'cannot afford' to pay staff compensation over data breach - BBC News
Organised Crime & Criminal Actors
US sanctions companies and individuals behind Southeast Asian scam centers | Crime News | Al Jazeera
Threat Actor Accidentally Exposes AI-Powered Operations - Infosecurity Magazine
Kosovo hacker pleads guilty to running BlackDB cybercrime marketplace
Bulletproof Host Stark Industries Evades EU Sanctions – Krebs on Security
Huntress's attacker surveillance splits infosec community • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency | Reuters
New Android RAT uses Near Field Communication to automatically steal money from devices | TechRadar
New RatOn Android Malware Targets Banking Apps and Crypto Wallets via NFC Attacks
Malicious npm Packages Steal Ethereum Keys in Typosquatting Attack
Hackers left empty-handed after massive NPM supply-chain attack
Insider Risk and Insider Threats
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency | Reuters
61% of US Companies Hit by Insider Data Breaches - Infosecurity Magazine
You Didn't Get Phished — You Onboarded the Attacker
Fake employers from North Korea hack hundreds | Cybernews
CISOs, stop chasing vulnerabilities and start managing human risk - Help Net Security
Students Pose Inside Threat to Education Sector
Supply Chain and Third Parties
71% of CISOs hit with third-party security incident this year | CSO Online
Hackers left empty-handed after massive NPM supply-chain attack
Mitigating supply chain vulnerabilities | TechRadar
Supply Chain Challenges and Solutions Outlined in Capgemini Report
Salesloft Breached via GitHub Account Compromise
Salesloft GitHub Account Compromised Months Before Salesforce Attack - SecurityWeek
Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack
Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack - SecurityWeek
Qualys Confirms Data Breach - Hackers Accessed Salesforce Data in Supply Chain Attack
Tenable Confirms Data Breach - Hackers Accessed Customers Contact Details
20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack
Cloud/SaaS
Microsoft now enforces MFA on Azure Portal sign-ins for all tenants
Azure mandatory multifactor authentication: Phase 2 starting in October 2025 | Microsoft Azure Blog
AI-Powered Phishing Attack Targets Microsoft 365 Accounts, Experts Warn | Ubergizmo
Microsoft's China cloud condundrum - Tech Monitor
Outages
Ransomware, vendor outages, and AI attacks are hitting harder in 2025 - Help Net Security
Microsoft fixes Exchange Online outage affecting users worldwide
Identity and Access Management
Are cybercriminals hacking your systems – or just logging in?
Identity management was hard, AI made it harder - Help Net Security
Encryption
Nearly 500 researchers urge EU to rethink controversial CSAM scanning proposal - Help Net Security
The New Math of Quantum Cryptography | WIRED
Brussels faces privacy crossroads over encryption backdoors • The Register
Passwords, Credential Stuffing & Brute Force Attacks
Are cybercriminals hacking your systems – or just logging in?
Beware of Malicious Facebook Ads With Meta Verified Steals User Account Details
Everything we know about the Plex data breach so far | IT Pro
Plex tells users to reset passwords after new data breach
Social Media
Beware of Malicious Facebook Ads With Meta Verified Steals User Account Details
Malvertising
Beware of Malicious Facebook Ads With Meta Verified Steals User Account Details
Regulations, Fines and Legislation
UK toughens Online Safety Act with ban on self-harm content • The Register
False Claims Act Expands to Cybersecurity Settlements
The Expanding Scope of FCA-Cybersecurity Liability | Sheppard Mullin Richter & Hampton LLP - JDSupra
CISA pushes final cyber incident reporting rule to May 2026 | CyberScoop
Experts poke holes in UK online safety regs • The Register
Brussels faces privacy crossroads over encryption backdoors • The Register
US politicians ponder Wimwig cyber intel sharing law | Computer Weekly
Banks warn of risks as critical cyber law nears expiration | American Banker
UK delays introducing new cybersecurity legislation, again | The Record from Recorded Future News
Trump Cuts Imperil Private Sector Cybersecurity Cooperation
Nearly 500 researchers urge EU to rethink controversial CSAM scanning proposal - Help Net Security
Patchy cyber workforce efforts face uncertain future under Trump
US government lacks clarity into its infosec workforce • The Register
CISA work not ‘degraded’ by Trump administration cuts, top agency official says | CyberScoop
Your Internet Access Is at Risk. We’re Speaking Up - Internet Society
The Newly Named Department Of War Goes To War On Cyber With 48 CFR Rule
Models, Frameworks and Standards
The Expanding Scope of FCA-Cybersecurity Liability | Sheppard Mullin Richter & Hampton LLP - JDSupra
CISA pushes final cyber incident reporting rule to May 2026 | CyberScoop
Careers, Working in Cyber and Information Security
CSO hiring on the rise: How to land a top security exec role | CSO Online
Law Enforcement Action and Take Downs
Kosovo hacker pleads guilty to running BlackDB cybercrime marketplace
Misinformation, Disinformation and Propaganda
Deepfakes are rewriting the rules of geopolitics - Help Net Security
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Chinese APT Actor Compromises Military Firm with Novel Fileless Malwar - Infosecurity Magazine
China went to 'EggStreme' lengths to attack Philippines • The Register
China
Elections watchdog admits 'painful lessons learned' after Chinese hack - BBC News
AI-powered penetration tool downloaded 10K times • The Register
Chinese APT Actor Compromises Military Firm with Novel Fileless Malwar - Infosecurity Magazine
Microsoft's China cloud condundrum - Tech Monitor
Chinese Spies Impersonated US Lawmaker to Deliver Malware to Trade Groups: Report - SecurityWeek
45 New Domains Linked to Salt Typhoon, UNC4841
'We have to act' on China, says Trump cybersecurity adviser | The National
American Security Systems are Compromised by China | RealClearDefense
China’s ‘Typhoons’ changing the way FBI hunts sophisticated threats | CyberScoop
China went to 'EggStreme' lengths to attack Philippines • The Register
Anthropic Bans Chinese Entities from Claude AI Over Security Risks
Czech cyber agency NUKIB flags Chinese espionage risks to critical infrastructure
NASA bars Chinese citizens from its facilities, networks • The Register
US tech firms ‘enabled China’s surveillance state’
Russia
Russian Offensive Cyber Operations: Analyzing Putin’s Foreign Policy Actions | Security Magazine
Russian Threat Group Targets Microsoft Outlook With Malware | Security Magazine
Russia targets WhatsApp and pushes new 'super-app' as internet blackouts grow - BBC News
Bulgaria U-turns on claim Moscow jammed GPS of von der Leyen's plane | Euronews
North Korea
Exclusive: How North Korean hackers are using fake job offers to steal cryptocurrency | Reuters
You Didn't Get Phished — You Onboarded the Attacker
Fake employers from North Korea hack hundreds | Cybernews
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
The US is now the largest investor in commercial spyware - Ars Technica
Tools and Controls
Critical 0-Click Vulnerability Enables Attackers to Takeover Email Access Using Punycode
Remote Access Abuse Biggest Pre-Ransomware Indicator - Infosecurity Magazine
Why security teams are turning to the dark web to protect executives - Digital Journal
Windows Defender Vulnerability Allows Service Hijacking and Disablement via Symbolic Link Attack
Cyber resilience matters as much as cyber defence - NCSC.GOV.UK
CISOs, stop chasing vulnerabilities and start managing human risk - Help Net Security
'Gentlemen' Ransomware Abuses Vulnerable Driver
Three Critical Facts About Cyber Risk Management | Trend Micro (US)
A CISO’s guide to monitoring the dark web | CSO Online
CISO's guide to security vendor consolidation | TechTarget
Microsoft Warns of Active Directory Domain Services Vulnerability, Let Attackers Escalate Privileges
AI-powered penetration tool downloaded 10K times • The Register
Identity management was hard, AI made it harder - Help Net Security
How attackers weaponize communications networks - Help Net Security
Reports Published in the Last Week
Other News
Working with partners to tackle cyber crime and fraud - GOV.UK
MeetC2 - A serverless C2 framework that leverages Google Calendar APIs as a communication channel
Firmware is the weak link in your PC's security. Here's how to stay safe | PCWorld
PayPal hacked? Here's how to regain control | PCWorld
Surge in networks scans targeting Cisco ASA devices raise concerns
Staff want compensation after summer cyber-attack
Attackers test the limits of railway cybersecurity - Help Net Security
Attackers are coming for drug formulas and patient data - Help Net Security
Vulnerability Management
Windows 10 losing security support in October – 6 ways to solve the problem - Which?
The Critical Failure in Vulnerability Management
Microsoft gives Windows 10 its penultimate update - but saves the best for Windows 11 | ZDNET
Vulnerabilities
Microsoft Patch Tuesday security updates for September 2025 fixed two zero-day flaws
Critical 0-Click Vulnerability Enables Attackers to Takeover Email Access Using Punycode
Windows Defender Vulnerability Allows Service Hijacking and Disablement via Symbolic Link Attack
Microsoft Warns of Active Directory Domain Services Vulnerability, Let Attackers Escalate Privileges
Akira ransomware crims abusing trifecta of SonicWall flaws • The Register
Critical SAP S/4HANA vulnerability now exploited in attacks
Top CMS Sitecore patches critical zero-day flaw being hit by hackers | TechRadar
Adobe Patches Critical ColdFusion and Commerce Vulnerabilities - SecurityWeek
Fortinet, Ivanti, Nvidia Release Security Updates - SecurityWeek
Microsoft, Adobe, SAP deliver critical fixes for September 2025 Patch Tuesday - Help Net Security
Cisco Patches High-Severity IOS XR Vulnerabilities - SecurityWeek
Windows 10 losing security support in October – 6 ways to solve the problem - Which?
'Gentlemen' Ransomware Abuses Vulnerable Driver
SAP Patches Critical NetWeaver (CVSS Up to 10.0) and High-Severity S/4HANA Flaws
Microsoft, Adobe, SAP deliver critical fixes for September 2025 Patch Tuesday - Help Net Security
Microsoft: Anti-spam bug blocks links in Exchange Online, Teams
Microsoft gives Windows 10 its penultimate update - but saves the best for Windows 11 | ZDNET
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory - 10 September 2025 - Security Updates from Microsoft, Adobe, Ivanti, SAP, Fortinet & NVIDIA
Black Arrow Cyber Advisory 10 September 2025 - Security Updates from Microsoft, Adobe, Ivanti, SAP, Fortinet & NVIDIA
Executive Summary
September’s security updates address a wide spectrum of enterprise risks. Microsoft patched critical flaws across Windows, Office, and Azure, while Adobe issued nine product advisories. SAP released 21 new notes, including several high impact NetWeaver and S/4HANA issues. NVIDIA fixed firmware flaws in DGX/HGX platforms. Fortinet disclosed two medium severity vulnerabilities in FortiDDoS F and FortiWeb. Ivanti published 13 vulnerabilities, 11 affecting Connect Secure, Policy Secure, ZTA and Neurons gateways, and 2 in Endpoint Manager, underscoring the importance of promptly securing VPN appliances and management servers. Collectively, these updates emphasise timely patching of Internet facing and business critical systems.
Vulnerabilities by Vendor
Microsoft[¹]: 86 vulnerabilities on the official September 2025 Security Update Guide release page, affecting Windows, Microsoft Edge (Chromium-based), Office, .NET/Developer Tools, and Azure components. Prioritise any items rated Critical, privilege escalation chains, and entries marked by Microsoft as “Exploited.”
Adobe[²]: 9 updates released to address vulnerabilities published on September 9 bulletins (Acrobat Reader, After Effects, Premiere Pro, Commerce, Substance 3D Viewer/Modeler, Experience Manager, Dreamweaver, ColdFusion). Prioritise server- or Internet-facing workloads (Commerce, ColdFusion) and high-impact desktop estates (Acrobat Reader).
Ivanti[³]: 13 vulnerabilities, comprising 11 in Connect Secure, Policy Secure, ZTA Gateways, and Neurons for Secure Access (five high, six medium) and 2 in Endpoint Manager (EPM 2024 SU3 / 2022 SU8) (both high-severity remote code execution requiring user interaction). No exploitation is reported. Prioritise patching Internet-facing gateway appliances and centralised EPM servers; also follow Ivanti’s guidance to avoid exposing admin portals to the Internet.
SAP[⁴]: 21 vulnerabilities in Security Notes on 9 September, affecting core platforms including NetWeaver, S/4HANA, Business One, LT Replication Server, Fiori, and BusinessObjects, among others. Prioritise Critical NetWeaver issues and high severity input validation and authentication weaknesses in S/4HANA and LT.
Fortinet[⁵]: 2 vulnerabilities, affecting FortiDDoS-F (OS command injection, CVSS 6.5) and FortiWeb (path traversal, CVSS 4.7). Both are medium-severity but exploitable by privileged or authenticated users. Prioritise updates for Internet-facing FortiWeb deployments and ensure FortiDDoS-F appliances are upgraded to fixed releases.
NVIDIA[⁶]: 2 vulnerabilities in HGX/DGX vBIOS and LS10 components (CVE-2025-23301, CVE-2025-23302). Prioritise firmware updates in AI/accelerator infrastructure (DGX/HGX), especially shared or multi-tenant environments.
What’s the risk to me or my business?
The presence of actively exploited zero-days and critical RCE/privilege escalation vulnerabilities across major enterprise platforms significantly elevates the risk of data breaches, lateral movement, malware deployment, and full system compromise.
What can I do?
Black Arrow recommends promptly applying the available security updates for all affected products. Prioritise patches for vulnerabilities that are actively exploited or rated as critical or high severity. Regularly review and update your organisation's security policies and ensure that all systems are running supported and up-to-date software versions.
Footnotes:
¹ Microsoft Security Update Guide (September 2025 release): https://msrc.microsoft.com/update-guide/releaseNote/2025-Sep
² Adobe Security Bulletins and Advisories: https://helpx.adobe.com/security/security-bulletin.html
³ Ivanti September 2025 Security Update: https://www.ivanti.com/blog/september-2025-security-update
⁴ SAP Security Patch Day September 2025: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2025.html
⁵ Fortinet PSIRT Advisories: https://www.fortiguard.com/psirt/FG-IR-25-512 ; https://www.fortiguard.com/psirt/FG-IR-24-344
⁶ NVIDIA Security Bulletin: NVIDIA HGX and DGX VBIOS and LS10 – September 2025: https://nvidia.custhelp.com/app/answers/detail/a_id/5674/~/security-bulletin%3A-nvidia-hgx-and-dgx-vbios-and-ls10---september-2025
Black Arrow Cyber Threat Intelligence Briefing 05 September 2025
Black Arrow Cyber Threat Intelligence Briefing 05 September 2025:
-Workers Told to Stay Home as Jaguar Land Rover Grapples with Attack: Manufacturing Shut Down, Sales Halted
-AI-Powered Cyber Crime Raises Worldwide Alarm Bells
-DDoS Attacks Serve as Instruments of Political Influence and Disruption
-Phishing Emails Are Getting Smarter and Using Some New Tricks to Snare Victims
-If You’re Using Microsoft Teams or Zoom, Beware: Hackers Could Be Targeting Your Company
-AI Impersonation Scams Are Sky-Rocketing in 2025 – Here’s How to Stay Safe
-Warning as 60% of Financial Attacks Start with Stolen Credentials
-Security Experts Call for Better ‘Offboarding’ Practices amid Spate of Insider Attacks by Outgoing Staff
-Boards Are Being Told to Rethink Their Role in Cyber Security
-Vibe Coding Creates Great Apps with Lax Security. But There Are Ways Around That.
-State-Sponsored Hackers Behind Majority of Vulnerability Exploits
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week’s review shows attackers continuing to disrupt operations through ransomware and large-scale attacks, with Jaguar Land Rover’s shutdown illustrating the ripple effect of a single breach. DDoS attacks are increasingly weaponised for political influence, amplified by AI-driven automation. At the same time, attackers continue to exploit human weaknesses: smarter phishing kits, fake Teams and Zoom invites, and AI-powered impersonation scams are targeting employees, while credential theft and poor offboarding practices remain major risks.
AI is also reshaping the threat landscape, enabling automated ransomware campaigns and deepfake-enabled fraud, while introducing new compliance challenges through AI-driven development. Boards are being urged to embed security into innovation and financial processes, and nation-state actors continue to exploit vulnerabilities in critical infrastructure.
These trends highlight the need for strong governance, technical and identity controls, and a culture of security awareness. Contact us to discuss proportionate ways to achieve this in your organisation.
Top Cyber Stories of the Last Week
Workers Told to Stay Home as Jaguar Land Rover Grapples with Attack: Manufacturing Shut Down, Sales Halted
Jaguar Land Rover has been forced to suspend production after a cyber attack disrupted its global IT systems, leaving thousands of factory workers at home. The incident has halted operations at key UK plants and prevented dealers from ordering parts or processing sales through normal channels, hitting the business during the peak registration period. Although there is currently no evidence that customer data has been stolen, the attack has severely impacted manufacturing, sales, and aftercare services, underlining how a single disruption can cascade across an entire organisation.
AI-Powered Cyber Crime Raises Worldwide Alarm Bells
A report from Anthropic has revealed how a hacker exploited its AI tools to automate an entire ransomware operation, targeting 17 organisations across healthcare, government, emergency services, and religious institutions. The AI system not only identified weaknesses but also created malicious software, drafted extortion emails, and calculated ransom demands ranging from $75,000 to over $500,000. Experts warn this case signals a turning point where criminals can weaponise AI to scale attacks quickly and cheaply. The incident highlights the urgent need for stronger governance, robust processes, and investment in AI-driven defence capabilities.
https://www.itsecurityguru.org/2025/08/29/ai-powered-cyber-crime-raises-worldwide-alarm-bells/
DDoS Attacks Serve as Instruments of Political Influence and Disruption
In the first half of 2025, more than 8 million distributed denial of service (DDoS) attacks were recorded worldwide with Europe, the Middle East and Africa experiencing 3.2 million of these incidents. Once mainly disruptive, such attacks are increasingly used as political tools, with spikes during events like the World Economic Forum and conflicts involving India, Pakistan, Iran and Israel. Attack durations and intensity are rising, fuelled by easy access to attack-for-hire services and automation powered by artificial intelligence. Traditional defences are struggling to cope, highlighting the need for organisations to adopt more advanced, intelligence-led protections.
https://www.helpnetsecurity.com/2025/09/04/ddos-attacks-worldwide-2025/
Phishing Emails Are Getting Smarter and Using Some New Tricks to Snare Victims
Barracuda researchers warn that Tycoon, a widely used phishing toolkit behind many email attacks, has been upgraded with new techniques that make malicious links harder to detect. These include disguising web addresses with hidden characters, fake security checks such as CAPTCHAs, and misleading domain names that appear linked to trusted companies. Such tactics are designed to bypass traditional email filters and trick recipients into clicking harmful links. Barracuda advises that organisations adopt multi-layered security measures, including advanced monitoring tools and regular staff awareness training, to better protect against these increasingly sophisticated threats.
If You’re Using Microsoft Teams or Zoom, Beware: Hackers Could Be Targeting Your Company
A new wave of cyber attacks is targeting companies through fake Microsoft Teams and Zoom invitations, exploiting the fact these platforms are used daily by billions of people. Researchers report over 900 organisations across the US, UK, Canada, and Australia have already been affected, with financial services and healthcare among the most targeted sectors. Once clicked, the fraudulent links install legitimate remote access software, giving attackers deep control of systems to steal data, take over accounts, or launch further attacks. Experts warn that stronger email defences and refreshed staff awareness training are critical safeguards.
AI Impersonation Scams Are Sky-Rocketing in 2025 – Here’s How to Stay Safe
AI impersonation scams have surged by 148% in 2025, with criminals using voice cloning and deepfake video to convincingly mimic trusted colleagues, friends or executives. These scams often exploit urgency to trick victims into making payments or disclosing sensitive information, with one case leading to a $25 million transfer. Experts warn that even professionals can be deceived, as nearly half of AI-generated scams bypass current security checks. The strongest defences are slowing down before reacting, verifying identities through trusted channels, and using multi-factor authentication to reduce the risk of account compromise.
Warning as 60% of Financial Attacks Start with Stolen Credentials
The UAE Cyber Security Council has warned that 60% of financial cyber attacks begin with stolen login details, making them a primary entry point for fraudsters. The Council stressed that simple protective steps, such as using multi factor authentication, biometric logins, and instant transaction alerts, can cut the risk of breaches by up to 40%. With over 12,000 incidents linked to unsecured public Wi-Fi this year, the Council highlighted how criminals exploit weak points in digital banking. It also cautioned that artificial intelligence is fuelling more complex and harder to detect online fraud schemes.
Security Experts Call for Better ‘Offboarding’ Practices amid Spate of Insider Attacks by Outgoing Staff
Experts warn that poor staff offboarding processes are leaving firms exposed to insider threats, with several recent cases showing how departing employees can steal sensitive data or sabotage systems. Examples include an Intel engineer fined for taking trade secrets and a former IT worker jailed for deleting 180 servers. With hybrid working giving wider access to company systems, the risk is growing. Security leaders stress that organisations must revoke access immediately when staff leave and strengthen collaboration between HR and IT. Automated identity management and monitoring tools are recommended to reduce the chance of serious damage.
Boards Are Being Told to Rethink Their Role in Cyber Security
A new report from Google Cloud stresses that boards must take a more active role in cyber security as it is now central to business resilience. It highlights three priorities: the rise of ransomware targeting identity systems and help desks, the rapid growth of cyber-enabled fraud such as email and payment scams, and the need to embed security into innovation. Boards are advised to back stronger identity protections, oversee fraud prevention in financial processes, and ensure security is considered early in new projects to build trust, protect growth, and maintain regulatory confidence.
https://www.helpnetsecurity.com/2025/09/01/google-board-cybersecurity-oversight/
Vibe Coding Creates Great Apps with Lax Security. But There Are Ways Around That.
Vibe coding, the use of plain text prompts in AI tools to generate software, offers speed and flexibility but introduces significant security and compliance risks. AI-generated code is often prone to errors and vulnerabilities, making regular reviews and monitoring essential. Experts advise restricting such projects to smaller, non-critical systems, using trusted platforms, and maintaining strict oversight to meet data protection rules such as GDPR. Transparency, documentation and human checks are vital to prevent regulatory breaches. Businesses that balance innovation with security controls will gain efficiency without exposing themselves to unnecessary legal or reputational risk.
https://www.techmonitor.ai/comment-2/vibe-coding-lax-security
State-Sponsored Hackers Behind Majority of Vulnerability Exploits
A new report has found that more than half of vulnerability exploits in early 2025 were carried out by state-sponsored groups, mainly linked to China, with aims such as espionage and surveillance. These campaigns focused on critical infrastructure and enterprise systems, while financially motivated groups accounted for the remaining 47%. Microsoft was the most targeted vendor, with its products linked to 17% of attacks. Alarmingly, most exploited flaws required no login details and nearly half could be launched remotely. The report also highlighted the rise of new social engineering tricks like ClickFix, which manipulates users into infecting themselves.
https://www.infosecurity-magazine.com/news/state-hackers-majority/
Governance, Risk and Compliance
Cybercrime increasingly moving beyond financial gains | CSO Online
How Firms Can Keep Cybersecurity Top of Mind | SC Media UK
Boards are being told to rethink their role in cybersecurity - Help Net Security
Software is 40% of security budgets as CISOs shift to AI defense | VentureBeat
Threats
Ransomware, Extortion and Destructive Attacks
JLR attack: How ransomware gangs have changed from cartels to cliques
Hackers Exploit Microsoft Teams to Taunt Victims and Demand Ransoms
How insurer strategies are evolving in response to the ransomware surge
Salesforce attackers threaten Google, FBI | Cybernews
What are ShinyHunters, the hackers that attacked Google? Should we all be worried?
Hacker Impatience Can Be a Good Thing
When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
New Dire Wolf Ransomware Attack Windows Systems, Deletes Event Logs and Backup-Related Data
Ransomware payments are banned in the public sector: should businesses still pay? | IT Pro
Hackers Exploit Third-Party SonicWall SSL VPNs to Deploy Sinobi Ransomware: By Parminder Saini
Here's how ransomware crims are abusing AI tools • The Register
Ransomware Victims
JLR attack: How ransomware gangs have changed from cartels to cliques
M&S hackers claim responsibility for Jaguar Land Rover attack
Sweden scrambles after ransomware attack puts sensitive worker data at risk
Nevada Confirms Ransomware Attack Behind Statewide Service Disruptions - SecurityWeek
M&S hackers suspects in Legal Aid Agency cyber-attack - Retail Gazette
Jaguar Land Rover says cyberattack ‘severely disrupted’ production
Dealerships unable to sell Range Rovers after JLR cyber attack
Ransomware attack shuts down Nevada Insurance Division website | Insurance Business America
Ransomware Attack on Pennsylvania’s AG Office Disrupts Court Cases - Infosecurity Magazine
Tire giant Bridgestone confirms cyberattack impacts manufacturing
Fired ChangeNOW worker wants hackers to pay| Cybernews
Phishing & Email Based Attacks
Phishing emails are getting smarter - and using some new tricks to snare victims | TechRadar
The Rise of BEC Attacks Targeting Government Agencies | Proofpoint US
The Old Ways Are Still the Best for Most Cybercriminals
New Phishing Attack Via OneDrive Attacking C-level Employs for Corporate Credentials
Tycoon Phishing Kit Utilizes New Capabilities to Hide Malicious Links - Infosecurity Magazine
Cybersecurity experts issue urgent warning amid surge in Stealerium malware attacks | IT Pro
Phishing Empire Runs Undetected on Google, Cloudflare
North Korean Hackers Exploit Threat Intel Platforms For Phishing - Infosecurity Magazine
DocuSign and Apple Pay Phishing Scam Steals User Credentials
North Korean Hackers Weaponize Seoul Intelligence Files - Infosecurity Magazine
VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages
What to do if your email has been hacked | Tom's Guide
Venus Protocol Recovers $13.5M in Phishing Attack
Business Email Compromise (BEC)/Email Account Compromise (EAC)
The Rise of BEC Attacks Targeting Government Agencies | Proofpoint US
Fraudster stole over $1.5 million from city of Baltimore
Other Social Engineering
If You're Using Microsoft Teams, Beware: Hackers Could Be Targeting Your Company
The Old Ways Are Still the Best for Most Cybercriminals
Scammers Will Try to Trick You Into Filling Out Google Forms. Don’t Fall for It | WIRED
A quick look at sextortion at scale: 1,900 messages and 205 Bitcoin addresses spanning four years
US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers - SecurityWeek
Children at risk of identity theft and fraud from 'sharenting' - BBC News
LinkedIn's new tools just made it tougher to pad your resume | ZDNET
Fraud, Scams and Financial Crime
Scammers Will Try to Trick You Into Filling Out Google Forms. Don’t Fall for It | WIRED
LinkedIn's new tools just made it tougher to pad your resume | ZDNET
The Rise of BEC Attacks Targeting Government Agencies | Proofpoint US
Fraudster stole over $1.5 million from city of Baltimore
Boards Partner with CISOs to Fight AI Cyber Fraud: Google Report
Hackers breach fintech firm in attempted $130M bank heist
Bitcoin’s record highs spark a surge in crypto scams | TechRadar
New threat group uses custom tools to hijack search results - Help Net Security
How to reclaim control over your online shopping data - Help Net Security
At Singapore’s anti-fraud convention, even the experts get scammed
Chinese Hackers Game Google to Boost Gambling Sites
New China-aligned crew poisons Windows servers for SEO fraud • The Register
FBI warns seniors are being targeted in three-phase Phantom Hacker scams | Fortra
Artificial Intelligence
AI-Powered Cyber Crime Raises Worldwide Alarm Bells. - IT Security Guru
AI Is Making Cybercrime Easier For Unsophisticated Criminals
Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure
AI brain Hexstrike runs cyberattacks on its own | Cybernews
Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malware | IT Pro
Cybercriminals Exploit X's Grok AI to Bypass Ad Protections and Spread Malware to Millions
Vibe coding creates brilliant, insecure apps. There are ways around that.
AI can't stop the sprint to adopt hot tech without security • The Register
Agentic AI: A CISO’s security nightmare in the making? | CSO Online
Exposed LLM Servers Expose Ollama Risks - InfoRiskToday
Here's how ransomware crims are abusing AI tools • The Register
Shadow AI Is Already in Your Stack – and It’s a Growing Threat for MSSPs | MSSP Alert
Winning the AI Arms Race in Financial Services Cybersecurity - Infosecurity Magazine
UAE Cybersecurity Council warns 60 per cent of financial attacks start with stolen credentials
Adversarial AI is coming for your applications | TechRadar
AI-Powered Cybercrime Is Here: Massive Breaches & Dark Web Dumps - Security Boulevard
Is artificial intelligence a friend, foe or frenemy? NIST wants to find out - Nextgov/FCW
AI code assistants improve production of security problems • The Register
File security risks rise as insiders, malware, and AI challenges converge - Help Net Security
New LinkedIn study reveals the secret that a third of professionals are hiding at work | ZDNET
Warner Bros. Discovery sues Midjourney AI for copying its characters | The Verge
Malware
Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
Cybersecurity experts issue urgent warning amid surge in Stealerium malware attacks | IT Pro
Fake PDF tools spread malware, warns NCSC | Cybernews
TamperedChef infostealer delivered through fraudulent PDF Editor
Cybercriminals Use Fake SEO Sites to Spread TamperedChef Malware via Bogus PDF Editor
Silver Fox Exploits Signed Drivers to Deploy ValleyRAT Backdoor - Infosecurity Magazine
Attackers Are Abusing Malicious PDFs: Here's How to Spot Them Early
Russian APT28 Deploys "NotDoor" Outlook Backdoor Against Companies in NATO Countries
File security risks rise as insiders, malware, and AI challenges converge - Help Net Security
Malicious npm Package nodejs-smtp Mimics Nodemailer, Targets Atomic and Exodus Wallets
Unknown miscreants snooping around Sitecore via sample keys • The Register
VirusTotal Finds 44 Undetected SVG Files Used to Deploy Base64-Encoded Phishing Pages
Bots/Botnets
TP-Link warns of botnet infecting routers and targeting Microsoft 365 accounts | Malwarebytes
Mobile
Android drops 120 flaw fixes, two exploited in the wild • The Register
Over 20 Popular Android VPN Apps Share The Same Security Flaws - See If You're Affected
What Android security threats should IT know about? | TechTarget
Apple Reportedly Still Under Pressure to Give UK Government Backdoor iCloud Access - CNET
UK's demand for Apple backdoor may have been broader than previously thought
Google is killing a defining feature for Android phones soon - and there's one reason why | ZDNET
Brokewell Android malware delivered through fake TradingView ads
Denial of Service/DoS/DDoS
Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps
DDoS attacks serve as instruments of political influence and disruption - Help Net Security
DDoSing is big and getting bigger – let's kill it off • The Register
Internet of Things – IoT
Severe Hikvision HikCentral product flaws: What You Need to Know
Connected cars are smart, convenient, and open to cyberattacks - Help Net Security
Cyber Trust Mark certification and how IoT devices will qualify | TechTarget
This Company Turns Dashcams into ‘Virtual CCTV Cameras.’ Then Hackers Got In
Tesla denied having fatal crash data until a hacker found it - Ars Technica
Data Breaches/Leaks
UK government dragged for incomplete security reforms • The Register
Warning issued to Salesforce customers after hackers stole Salesloft Drift data | IT Pro
Salesloft Takes Drift Offline After OAuth Token Theft Hits Hundreds of Organizations
Zscaler, Palo Alto Networks Hacked via Salesloft Drift
JSON Config File Leaks Azure AD Credentials
Security Firms Hit by Salesforce–Salesloft Drift Breach - SecurityWeek
Attackers are turning Salesforce trust into their biggest weapon - Help Net Security
Salesloft Drift attack affects Google Workspace security | Proton
Air France Sued Over ‘Hub-and-Spoke’ Salesforce Cyberattack
Blast Radius of Salesloft Drift Attacks Remains Unclear
Sweden scrambles after ransomware attack puts sensitive worker data at risk
Gmail users warned as hackers gain access to private information
Government needs to go ‘further and faster’ on information security improvements – PublicTechnology
Social Security whistleblower who claims DOGE mishandled Americans' sensitive data resigns from post
'2.5 billion Gmail users at risk'? Entirely false, says Google | ZDNET
Chess.com discloses recent data breach via file transfer app
Texas sues PowerSchool over breach exposing 62M students, 880k Texans
Organised Crime & Criminal Actors
AI Is Making Cybercrime Easier For Unsophisticated Criminals
How to reclaim control over your online shopping data - Help Net Security
The Old Ways Are Still the Best for Most Cybercriminals
Hacker Impatience Can Be a Good Thing
Chinese Hackers Game Google to Boost Gambling Sites
New China-aligned crew poisons Windows servers for SEO fraud • The Register
Call for UK to lead on organised crime | Professional Security Magazine
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Bitcoin’s record highs spark a surge in crypto scams | TechRadar
A quick look at sextortion at scale: 1,900 messages and 205 Bitcoin addresses spanning four years
Malicious npm Package nodejs-smtp Mimics Nodemailer, Targets Atomic and Exodus Wallets
Venus Protocol Recovers $13.5M in Phishing Attack
Fired ChangeNOW worker wants hackers to pay| Cybernews
Insider Risk and Insider Threats
File security risks rise as insiders, malware, and AI challenges converge - Help Net Security
LinkedIn's new tools just made it tougher to pad your resume | ZDNET
US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers - SecurityWeek
Insurance
How insurer strategies are evolving in response to the ransomware surge
Cyber insurance faces rate deterioration and reduced organic growth: Swiss Re - Reinsurance News
Supply Chain and Third Parties
Warning issued to Salesforce customers after hackers stole Salesloft Drift data | IT Pro
Supply-chain attack hits Zscaler via Salesloft Drift, leaking customer info
Security Firms Hit by Salesforce–Salesloft Drift Breach - SecurityWeek
Attackers are turning Salesforce trust into their biggest weapon - Help Net Security
Salesloft Drift attack affects Google Workspace security | Proton
Air France Sued Over ‘Hub-and-Spoke’ Salesforce Cyberattack
Blast Radius of Salesloft Drift Attacks Remains Unclear
16 Billion Records Exposed in Supply-Chain Data Breach on Gmail, Apple, Facebook
Cloud/SaaS
If You're Using Microsoft Teams, Beware: Hackers Could Be Targeting Your Company
JSON Config File Leaks Azure AD Credentials
TP-Link warns of botnet infecting routers and targeting Microsoft 365 accounts | Malwarebytes
Phishing Empire Runs Undetected on Google, Cloudflare
Hackers Exploit Microsoft Teams to Taunt Victims and Demand Ransoms
AWS nails Russia's Cozy Bear trying to nick Microsoft creds • The Register
Amazon Dismantles Russian APT 29 Infrastructure Used to Attack Users
Amazon Stops Russian APT29 Watering Hole Attack - Infosecurity Magazine
Encryption
Apple Reportedly Still Under Pressure to Give UK Government Backdoor iCloud Access - CNET
UK's demand for Apple backdoor may have been broader than previously thought
What Q Day means for your business and how to prepare | TechRadar
UK's Broader Demand for Apple iCloud Backdoor Sparks Encryption Clash
Court documents shed new light on UK-Apple row over user data - BBC News
Linux and Open Source
Linux UDisks daemon Vulnerability Let Attackers Gaining Access to Files Owned by Privileged Users
Passwords, Credential Stuffing & Brute Force Attacks
UAE Cybersecurity Council warns 60 per cent of financial attacks start with stolen credentials
TP-Link warns of botnet infecting routers and targeting Microsoft 365 accounts | Malwarebytes
The Old Ways Are Still the Best for Most Cybercriminals
DocuSign Phishing Scam Mimics Apple Pay Disputes to Steal Data
DocuSign and Apple Pay Phishing Scam Steals User Credentials
'2.5 billion Gmail users at risk'? Entirely false, says Google | ZDNET
No, Google did not warn 2.5 billion Gmail users to reset passwords
Google says Gmail security is “strong and effective” as it denies major breach - Ars Technica
Social Media
LinkedIn's new tools just made it tougher to pad your resume | ZDNET
Children at risk of identity theft and fraud from 'sharenting' - BBC News
Disney to pay $10M to settle claims it collected kids’ data on YouTube
Regulations, Fines and Legislation
UK's Broader Demand for Apple iCloud Backdoor Sparks Encryption Clash
Court documents shed new light on UK-Apple row over user data - BBC News
Security experts weigh in on UK's proposed VPN crackdown - Raconteur
Big Tech Companies in the US Have Been Told Not to Apply the Digital Services Act | WIRED
The House | The cyber security bill must go further to truly protect the UK economy
Why are so many organizations dragging their feet on NIS2 compliance? | TechRadar
Apple Reportedly Still Under Pressure to Give UK Government Backdoor iCloud Access - CNET
UK's demand for Apple backdoor may have been broader than previously thought
Ransomware payments are banned in the public sector: should businesses still pay? | IT Pro
Google Fined $379 Million by French Regulator for Cookie Consent Violations
Google told to pay $425m in privacy lawsuit - BBC News
France fines Google, SHEIN, for undercooked Cookie policies • The Register
UK human rights regulator to argue against police use of live facial recognition | Biometric Update
Cyber Trust Mark certification and how IoT devices will qualify | TechTarget
Congress tosses lifeline to cyber intel sharing, grants • The Register
Models, Frameworks and Standards
The House | The cyber security bill must go further to truly protect the UK economy
Big Tech Companies in the US Have Been Told Not to Apply the Digital Services Act | WIRED
Why are so many organizations dragging their feet on NIS2 compliance? | TechRadar
Cyber Trust Mark certification and how IoT devices will qualify | TechTarget
Is artificial intelligence a friend, foe or frenemy? NIST wants to find out - Nextgov/FCW
NIST revision of SP 800-53 highlights rising stakes in patch, update security | Biometric Update
NIST Enhances Security Controls for Improved Patching
Careers, Working in Cyber and Information Security
How gaming experience can help with a cybersecurity career - Help Net Security
Fintech CISO on How AI is Changing Cybersecurity Skillsets - Infosecurity Magazine
Law Enforcement Action and Take Downs
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
A Playbook for Winning the Cyber War: Part 1: Executive Summary
A Playbook for Winning the Cyber War: Part 2: Evaluating Russia’s Cyber Strategy
A Playbook for Winning the Cyber War: Part 3: Evaluating China’s Cyber Strategy
A Playbook for Winning the Cyber War: Part 4: Evaluating Iran’s Cyber Strategy
A Playbook for Winning the Cyber War: Part 5: Evaluating U.S. Cyber Strategy
A Playbook for Winning the Cyber War: Part 7: How the United States Can Win
Nation State Actors
State-Sponsored Hackers Behind Majority of Vulnerability Exploits - Infosecurity Magazine
China
A Playbook for Winning the Cyber War: Part 1: Executive Summary
A Playbook for Winning the Cyber War: Part 3: Evaluating China’s Cyber Strategy
State-Sponsored Hackers Behind Majority of Vulnerability Exploits - Infosecurity Magazine
Chinese APT Hackers Exploit Router Vulnerabilities to Infiltrate Enterprise Environments
Salt Typhoon APT techniques revealed in new report | CSO Online
US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers - SecurityWeek
Czech Republic warns of Chinese solar inverter threat - PV Tech
Trump and JD Vance among targets of major Chinese cyberattack, investigators say | Euronews
Chinese Hackers Game Google to Boost Gambling Sites
New China-aligned crew poisons Windows servers for SEO fraud • The Register
US sues robot toy maker for exposing children's data to Chinese devs
Russia
A Playbook for Winning the Cyber War: Part 1: Executive Summary
A Playbook for Winning the Cyber War: Part 2: Evaluating Russia’s Cyber Strategy
State-Sponsored Hackers Behind Majority of Vulnerability Exploits - Infosecurity Magazine
Amazon Dismantles Russian APT 29 Infrastructure Used to Attack Users
APT28 Targets Microsoft Outlook With 'NotDoor' Malware
Russian APT28 Deploys "NotDoor" Outlook Backdoor Against Companies in NATO Countries
NATO takes aim at Russia’s GPS hacking after EU leader’s plane jammed
Sweden says Russia behind surge in GPS jamming over Baltic Sea - BBC News
US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers - SecurityWeek
AWS nails Russia's Cozy Bear trying to nick Microsoft creds • The Register
Amazon Stops Russian APT29 Watering Hole Attack - Infosecurity Magazine
EU blames Russia as GPS jamming disrupts president’s plane • The Register
US puts $10M bounty on Russians accused of infra attacks • The Register
Iran
A Playbook for Winning the Cyber War: Part 1: Executive Summary
A Playbook for Winning the Cyber War: Part 4: Evaluating Iran’s Cyber Strategy
Iran MOIS Phishes 50+ Embassies, Ministries, Int'l Orgs
North Korea
State-Sponsored Hackers Behind Majority of Vulnerability Exploits - Infosecurity Magazine
Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE
US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers - SecurityWeek
North Korean Hackers Exploit Threat Intel Platforms For Phishing - Infosecurity Magazine
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Internet mapping service Censys reveals state-based abuse • The Register
ICE Revives Contract With Controversial Spyware Firm Paragon
Commercial surveillanceware shrugs off sanctions, regulation • The Register
Tools and Controls
New Dire Wolf Ransomware Attack Windows Systems, Deletes Event Logs and Backup-Related Data
Security experts weigh in on UK's proposed VPN crackdown - Raconteur
How insurer strategies are evolving in response to the ransomware surge
When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider
Software is 40% of security budgets as CISOs shift to AI defense | VentureBeat
Attackers Abuse Velociraptor Forensic Tool to Deploy Visual Studio Code for C2 Tunneling
BruteForceAI: Free AI-powered login brute force tool - Help Net Security
Security tool bloat Is the new breach vector | TechRadar
Why you should delete your browser extensions right now - or do this to stay safe | ZDNET
Please stop using your ISP's DNS
A spy among us: rethinking cybersecurity in a hybrid world | TechRadar
6 browser-based attacks all security teams should be ready for in 2025
North Korean Hackers Exploit Threat Intel Platforms For Phishing - Infosecurity Magazine
Cyber insurance faces rate deterioration and reduced organic growth: Swiss Re - Reinsurance News
Vibe coding creates brilliant, insecure apps. There are ways around that.
Winning the AI Arms Race in Financial Services Cybersecurity - Infosecurity Magazine
Why one-time security assessments are no longer sufficient [Q&A] - BetaNews
US, Allies Push for SBOMs to Bolster Cybersecurity - SecurityWeek
Threat Hunting Should Be Part of Every Security Program
AI code assistants improve production of security problems • The Register
These 4 antivirus apps are actually worse than malware
Fewer than half of Irish companies automatically back up data, survey shows – The Irish Times
Other News
Security tool bloat Is the new breach vector | TechRadar
Gen Z has a cyber hygiene problem | IT Pro
Traffic to government domains often crosses national borders • The Register
They know where you are: Cybersecurity and the shadow world of geolocation
Fewer than half of Irish companies automatically back up data, survey shows – The Irish Times
Is retail a sitting duck for cybercriminals? | Retail Week
Why resilience in automotive cybersecurity must stretch beyond data protection - Tech Monitor
Vulnerability Management
State-Sponsored Hackers Behind Majority of Vulnerability Exploits - Infosecurity Magazine
Why cyber risks lurk in legacy technology | CIO Dive
NIST revision of SP 800-53 highlights rising stakes in patch, update security | Biometric Update
PoC Code in 15 Minutes? AI Turbocharges Exploitation
Enterprises staying on Windows 10 could shell out billions • The Register
Hacked Routers Linger on the Internet for Years
Windows 11 security updates are now unskippable during setup | PCWorld
Cutting through CVE noise with real-world threat signals - Help Net Security
Healthcare Sector Takes 58 Days to Resolve Serious Vulnerabilities - Infosecurity Magazine
AI can help track an ever-growing body of vulnerabilities, CISA official says | CyberScoop
Vulnerabilities
Critical Citrix 0-Day Vulnerability Exploited Since May, Leaving Global Entities Exposed
Hackers Exploit Third-Party SonicWall SSL VPNs to Deploy Sinobi Ransomware: By Parminder Saini
WhatsApp Issues Emergency Update for Zero-Click Exploit Targeting iOS and macOS Devices
CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation
macOS vulnerability allowed Keychain and iOS app decryption without a password - Help Net Security
Linux UDisks daemon Vulnerability Let Attackers Gaining Access to Files Owned by Privileged Users
Silver Fox Exploits Signed Drivers to Deploy ValleyRAT Backdoor - Infosecurity Magazine
High-Risk SQLi Flaw Exposes WordPress Memberships Plugin Users - Infosecurity Magazine
WordPress Theme Vulnerability Exposes 70K Sites to CSRF, SQL Attacks
WordPress Woes Continue Amid ClickFix, TDS Threats
Paid WordPress users beware - worrying security flaw puts accounts and info at risk | TechRadar
CISA Adds TP-Link and WhatsApp Flaws to KEV Catalog Amid Active Exploitation
Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers - SecurityWeek
Sitecore zero-day vulnerability exploited by attackers (CVE-2025-53690) - Help Net Security
Microsoft says recent Windows updates cause app install issues
Severe Hikvision HikCentral product flaws: What You Need to Know
Enterprise password crew Passwordstate patches auth vuln • The Register
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 29 August 2025
Black Arrow Cyber Threat Intelligence Briefing 29 August 2025:
-Fake IT Support Attacks Hit Microsoft Teams
-KnowBe4 Report Reveals Global Financial Sector Faces Unprecedented Cyber Threat Surge
-Cyber Moves from Back Office to Boardroom, and Investors Are Paying Attention
-CISOs Evolve from Guardians to Strategic Business Architects
-Incident Response Planning Emerges as a Key Cyber Security Control in Reducing Risk: Marsh McLennan
-Insurers May Limit Payments in Cases of Unpatched Vulnerabilities
-Anatsa Android Banking Trojan Now Targeting 830 Financial Apps with 19m Downloads
-The Hidden Threat in Enterprise Security: Why It’s Time to Rethink PDFs
-Infostealers: The Silent Smash-and-Grab Driving Modern Cyber Crime
-New Cyber Threats Emerge as Old Ransomware Groups Collapse
-Ransomware Cyber Attack Virtually Shuts Down Entire US State
-Chinese Threat Actor Salt Typhoon Cyber Spies Breached 80+ Nations, FBI Warns
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
Our review of threat intelligence this week reinforces that cyber attackers target employees to get into the organisation’s systems: attacks via Microsoft Teams have come to the fore again, alongside more classic email phishing. We also look at how the C-Suite is addressing the challenge of cyber security, bringing the subject to the Board as a strategic enabler; this includes strengthening the leadership team’s ability to respond to a cyber incident. While many organisations look to their insurance policy as a safety net during an incident, we report on how insurers may limit their payments if they find that the organisation has not maintained sufficient security.
The second half of our review includes details of emerging and developing attacks, from Android banking applications to PDFs and information stealers. Ransomware continues to surge, driven by new attacker groups that formed after others were shut down by law enforcement; recent victims include multiple state agencies in the USA, while we also report that Chinese state-backed attackers are embedding themselves into the critical national infrastructure of countries across the world.
We remain clear that the way to improve your resilience against a cyber incident is to implement a cyber strategy based on an impartial assessment of your specific cyber risks, and to confirm how you will respond to an incident through a rehearsal exercise facilitated by an unbiased independent expert who will help you uncover and address misconceptions. All of this must be underpinned by proportionate governance aligned to a recognised framework or standard. Contact us for a no-obligation discussion on how this can work in your organisation.
Top Cyber Stories of the Last Week
Fake IT Support Attacks Hit Microsoft Teams
Researchers have uncovered a new phishing campaign exploiting Microsoft Teams, where attackers pose as IT support staff to trick employees into downloading remote access tools. Once installed, these tools give criminals full control of a system, allowing them to steal login details and install malicious software. The activity has been linked to a financially motivated group known as EncryptHub. The use of Teams highlights a shift away from traditional email-based attacks, embedding threats directly into everyday business communication. Organisations are advised to monitor Teams traffic closely, particularly for suspicious external contacts.
https://www.infosecurity-magazine.com/news/fake-support-attacks-hit-microsoft/
KnowBe4 Report Reveals Global Financial Sector Faces Unprecedented Cyber Threat Surge
Financial institutions now face cyber attacks at a scale far beyond other industries, experiencing up to 300 times more incidents annually, with intrusions rising 25% last year. Almost all major banks suffered supplier-related breaches, underlining the weakness of third-party ecosystems. The most worrying factor is people: the report found that nearly half of employees in large banks were vulnerable to phishing tests, though this can be reduced to below 5% with proper awareness training. Attackers are increasingly using stolen credentials, making detection harder and highlighting the urgent need to address human risk as part of a cyber security strategy.
Cyber Moves from Back Office to Boardroom, and Investors Are Paying Attention
Boardrooms are now treating cyber security as a core strategic priority, with 72% of UK firms and almost all large businesses rating it as high importance. High profile breaches at major retailers have highlighted that strong defences protect not only operations but also brand value and investor confidence. Regulation is also reshaping the agenda and investors are responding, with private equity driving a surge in acquisitions of specialist firms. Increasingly, boards are favouring tailored, advisory-led solutions over generic products, embedding cyber resilience into long-term strategy.
CISOs Evolve from Guardians to Strategic Business Architects
The role of the Chief Information Security Officer (CISO) is shifting from a technical defender to a strategic business leader. Increasingly, CISOs are expected to embed cyber security into core decision-making, influence board discussions, and translate complex risks into clear business impacts. This change is driven by advances in artificial intelligence, stricter regulations, and more sophisticated cyber threats. While challenges remain around credibility and alignment with other executives, CISOs who position security as a business enabler can strengthen resilience, support growth, and ensure that security strategy contributes directly to long-term success.
https://www.webpronews.com/cisos-evolve-from-guardians-to-strategic-business-architects/
Incident Response Planning Emerges as a Key Cyber Security Control in Reducing Risk: Marsh McLennan
A new report from Marsh McLennan highlights that cyber incident response planning is one of the most effective ways to reduce the likelihood of a breach-related claim. Organisations that run regular response exercises are 13% less likely to suffer a significant cyber event compared with those that do not. The research shows response planning ranks as the fourth most effective control, after threat detection, monitoring, and staff awareness training. The findings stress that security tools such as detection systems and multi-factor authentication must not only be deployed but also actively managed to strengthen resilience.
Insurers May Limit Payments in Cases of Unpatched Vulnerabilities
Some cyber insurers are exploring limits on payouts where firms have not fixed known security flaws quickly enough, a move referred to as CVE exclusions. This approach could see claims reduced if attackers exploit older weaknesses, though it is not yet widely adopted. With more than 46,000 software vulnerabilities expected in 2025, around a third rated high or critical, many firms struggle to keep pace due to operational and legacy system constraints. Critics argue exclusions undermine the purpose of cyber insurance as a financial safeguard, and senior leaders should ensure they understand and challenge policy terms before committing.
https://www.darkreading.com/cyber-risk/cyber-insurers-may-limit-payments-breaches-unpatched-cve
Anatsa Android Banking Trojan Now Targeting 830 Financial Apps with 19m Downloads
The Anatsa Android banking trojan has grown significantly, now targeting over 830 financial and cryptocurrency applications worldwide. Previously active mainly in Europe, it has expanded into Germany and South Korea, with over 150 new applications added to its list. Criminals distribute the malware through fake apps on Google Play, some apps have been downloaded more than 50,000 times, with a combined total of 19 million installs across all apps, which then secretly install malicious updates. Once active, Anatsa can steal login details, intercept messages and perform fraudulent transactions. Google has since removed the identified apps, but the threat underlines the continuing risks of mobile banking and cryptocurrency platforms.
https://www.securityweek.com/anatsa-android-banking-trojan-now-targeting-830-financial-institutions/
The Hidden Threat in Enterprise Security: Why It’s Time to Rethink PDFs
PDFs remain a largely overlooked cyber security risk, despite being central to contracts, invoices, and compliance records. Many organisations still treat them as static files, yet attackers increasingly exploit them to deliver malicious software, with over 560,000 new malware variants emerging daily. Poor document governance can also create legal liabilities under GDPR and other regulations. As AI-powered attacks accelerate breaches, unsecured PDFs present a growing weakness. Security must be embedded throughout the document lifecycle with encryption, permissions, and secure collaboration to reduce risk while supporting compliance and resilience.
https://www.techradar.com/pro/the-hidden-threat-in-enterprise-security-why-its-time-to-rethink-pdfs
Infostealers: The Silent Smash-and-Grab Driving Modern Cyber Crime
Infostealers have rapidly become one of the most damaging tools in modern cyber crime, operating as silent data theft mechanisms that can compromise systems in minutes. Once requiring specialist skills, these tools are now widely available for purchase, driving a surge in attacks by less technical criminals. Stolen information, ranging from passwords and corporate VPN access to cloud credentials, is sold at scale on criminal marketplaces and has enabled major breaches such as the 2024 Snowflake incident, which affected more than 160 organisations. Their speed, stealth, and accessibility make them a growing risk for businesses worldwide.
https://www.securityweek.com/infostealers-the-silent-smash-and-grab-driving-modern-cybercrime/
New Cyber Threats Emerge as Old Ransomware Groups Collapse
Ransomware attacks have risen by 179% since mid-2024, fuelled by new criminal groups stepping in as law enforcement disrupts older gangs. Some now focus solely on extortion by stealing data rather than locking systems, while others recycle leaked code or rebrand under fresh names. At the same time, state-linked actors are targeting government, legal, and technology sectors, often exploiting weaknesses in cloud services and third-party providers to reach wider victims. The use of artificial intelligence and advanced malware highlights that while well-known groups may collapse, the overall threat to organisations remains undiminished and increasingly sophisticated.
https://techinformed.com/new-cyber-threats-emerge-as-old-ransomware-groups-collapse/
Ransomware Cyber Attack Virtually Shuts Down Entire US State
A major ransomware cyber attack has disrupted multiple state agencies in Nevada, including the Department of Motor Vehicles and the Gaming Control Board which oversees operations on the Las Vegas Strip. The incident has forced some police departments to revert to manual record-keeping and disrupted public benefit services. While officials first reported no loss of personal data, evidence has since confirmed that some information was stolen. The Governor’s office continues to monitor the situation, but the scale of the breach and recovery timeline remain uncertain, with the FBI now leading investigations and warning citizens to be alert to related scams.
https://www.independent.co.uk/bulletin/news/nevada-cyber-attack-hacking-ransomware-b2816108.html
Chinese Threat Actor Salt Typhoon Cyber Spies Breached 80+ Nations, FBI Warns
The FBI, alongside security agencies from more than a dozen nations including the UK’s NCSC, have warned that a Chinese state-sponsored group known as Salt Typhoon has breached critical infrastructure in over 80 countries, including more than 200 organisations in the US alone. Active since 2019, the group has targeted sectors ranging from telecommunications and transport to defence and government, using stealthy methods to infiltrate routers, surveillance systems, and even lawful intercept tools. Authorities say Salt Typhoon remains active, with hidden re-entry points making removal difficult, and urge organisations to strengthen defences and adopt continuous monitoring practices.
https://www.techrepublic.com/article/news-salt-typhoon-cyber-spies-breach/
Governance, Risk and Compliance
Boards should bear ultimate responsibility for cybersecurity - BetaNews
Cyber moves from back office to boardroom – and investors are paying attention | TechRadar
Financial sector faces surge in cyber threats - BetaNews
Tabletop drills cut cyber event likelihood by 13% – report - CIR Magazine
Cyber Insurers May Limit Payouts for Breaches via Flaws
Personal Liability, Security Big Issues for CISOs
Human risk and Gen AI-driven data loss top CISO concerns - BetaNews
CISOs Evolve from Guardians to Strategic Business Architects
Cyber pros say the buck stops with the board when it comes to security failings | IT Pro
Concealing cyberattacks risks penalties and harms trust - BetaNews
Cyber security response rising up the agenda
How Boards Can Prepare for Increasing Nation-State Cyber Threats
Building Human Firewalls: Key to Combating Cyber Threats
The evolving CISO role: bridging the gap between security and strategy | TechRadar
CIISec: Most Security Professionals Want Stricter Regulations - Infosecurity Magazine
Regulatory compliance: Act now | TechRadar
Cyber Outlook Report Finds Gaps, Outlines Holistic Approach to Protections
5 Practices to Ensure Your Ecosystem Is Cyber-Secure
How CISOs are balancing risk, pressure and board expectations - Help Net Security
Finding connection and resilience as a CISO - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware attack volumes up nearly three times on 2024 | Computer Weekly
New cyber threats emerge as old ransomware groups collapse
Storm-0501 attacked Azure, demanded payment via Teams • The Register
AI Boosts Ransomware Attacks 70%, Fueling Cybersecurity Arms Race
Cybersecurity company ESET warns AI now being used in ransomware attacks - Business Plus
Criminals Are Vibe Hacking With AI To Carry Out Ransoms At Scale: Anthropic
Ransomware Actor Deletes Data and Backups Post-Exfiltration on Azure - Infosecurity Magazine
Organized and Criminal, Ransomware Gangs Run Up Profits - Security Boulevard
First AI-powered ransomware PoC spotted • The Register
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Hook Android Trojan Delivers Ransomware-Style Attacks
Underground Ransomware Gang With New Tactics Against Organizations Worldwide
Cephalus ransomware: What you need to know | Fortra
Emulating the Expedited Warlock Ransomware - Security Boulevard
Experimental PromptLock ransomware uses AI to encrypt, steal data
Someone Created the First AI-Powered Ransomware Using OpenAI's gpt-oss:20b Model
‘Vibe-hacking’ is now a top AI threat | The Verge
When ransomware hits home: putting your people first | TechRadar
Akira, Cl0p Top "5 Most Active Ransomware Groups" List
AI Meets Ransomware, The New Cyber Threat | Scoop News
Ransomware Gangs Are Bleeding the Healthcare Supply Chain | MSSP Alert
Ransomware Victims
Ransomware cyber attack virtually shuts down US state | The Independent
When One Hospital Gets Ransomware, Others Feel the Pain
Qilin Ransomware Hits Nissan: 4TB of Vehicle Designs Stolen
Electronics manufacturer Data I/O took offline operational systems following a ransomware attack
Data I/O ransomware attack ‘temporarily impacted’ operations • The Register
Phishing & Email Based Attacks
'ZipLine' Phishers Flip Script as Victims Email First
Fake IT Support Attacks Hit Microsoft Teams - Infosecurity Magazine
Microsoft urges to limit CLI tools as phishing rages | Cybernews
Fast-Spreading, Complex Phishing Campaign Installs RATs
Phishing Campaign Uses UpCrypter in Fake Voicemail Emails to Deliver RAT Payloads
Off-the-shelf tools make life easier for phishing attackers - BetaNews
New Phishing Campaign Abuses ConnectWise ScreenConnect to Take Over De - Infosecurity Magazine
Hackers Exploit Linux RAR Flaws in Phishing to Deploy VShell Backdoor
Compromised at the Core: Why Identity Remains Cyber’s Biggest Flaw | SC Media UK
Google Breach Exposes 2.5 Billion Gmail Accounts to Phishing Attacks
Transparent Tribe Targets Indian Govt With Weaponized Desktop Shortcuts via Phishing
What small businesses must do now to stay ahead of phishing | SC Media
Other Social Engineering
Fake IT Support Attacks Hit Microsoft Teams - Infosecurity Magazine
Fake CAPTCHA tests trick users into running malware • The Register
How social engineering is the weakest link in cyber defence
New Attack Tricks AI Summaries Into Pushing Malware
Phishing Campaign Uses UpCrypter in Fake Voicemail Emails to Deliver RAT Payloads
Fake Apple Support Sites Spread Malware Evading macOS Defenses
What is SIM swap attack (SIM intercept attack)? | Definition from TechTarget
Attackers exploit Zoom and Teams impersonations to deliver ScreenConnect malware - SiliconANGLE
Treasury sanctions North Korea IT worker scheme facilitators and front organizations | CyberScoop
Can We Really Eliminate Human Error in Cybersecurity? - Security Boulevard
ScreenConnect admins targeted with spoofed login alerts - Help Net Security
Crooks are getting ready for FIFA World Cup 2026 | Cybernews
Fraud, Scams and Financial Crime
Operation Serengeti 2.0: INTERPOL nabs 1,209 cybercriminals in Africa, seizes $97M
iPhone Users 20% More Likely to Fall for Scams Than Android, Study Shows
ScamAgent shows how AI could power the next wave of scam calls - Help Net Security
Anatsa Android Banking Trojan Now Targeting 830 Financial Apps - SecurityWeek
Crypto Companies Freeze $47m in Romance Baiting Funds - Infosecurity Magazine
Crooks are getting ready for FIFA World Cup 2026 | Cybernews
FCC removes 1,200 voice providers from telephone networks in major robocall crackdown | CyberScoop
69% of Consumers Believe AI Fraud Is the Biggest Identity Threat | Security Magazine
Artificial Intelligence
New Attack Tricks AI Summaries Into Pushing Malware
AI Boosts Ransomware Attacks 70%, Fueling Cybersecurity Arms Race
Criminals Are Vibe Hacking With AI To Carry Out Ransoms At Scale: Anthropic
Human risk and Gen AI-driven data loss top CISO concerns - BetaNews
ScamAgent shows how AI could power the next wave of scam calls - Help Net Security
Cybersecurity company ESET warns AI now being used in ransomware attacks - Business Plus
Experimental PromptLock ransomware uses AI to encrypt, steal data
‘Vibe-hacking’ is now a top AI threat | The Verge
Rowhammer attack can backdoor AI models with one devastating bit flip | CSO Online
AI Security Map: Linking AI vulnerabilities to real-world impact - Help Net Security
Anthropic Warns of ‘Sophisticated’ Cybercrime Via Claude LLM
LLMs Face Persistent Prompt Injection Vulnerabilities
We Are Still Unable to Secure LLMs from Malicious Inputs - Security Boulevard
Detecting and countering misuse of AI: August 2025 \ Anthropic
1,000+ Devs Lose Their Secrets to an AI-Powered Stealer
69% of Consumers Believe AI Fraud Is the Biggest Identity Threat | Security Magazine
The 5 Golden Rules of Safe AI Adoption
The do’s and don’ts of vibe coding - Fast Company
Researchers warn of security flaws in AI-powered browsers | TechSpot
Anthropic thwarts hacker attempts to misuse Claude AI for cybercrime | Reuters
OpenAI increases ChatGPT user protections following wrongful death lawsuit | ZDNET
Malware
New Attack Tricks AI Summaries Into Pushing Malware
Fake CAPTCHA tests trick users into running malware • The Register
Infostealers: The Silent Smash-and-Grab Driving Modern Cybercrime - SecurityWeek
Phishing Campaign Uses UpCrypter in Fake Voicemail Emails to Deliver RAT Payloads
Fake Apple Support Sites Spread Malware Evading macOS Defenses
Attackers exploit Zoom and Teams impersonations to deliver ScreenConnect malware - SiliconANGLE
Fast-Spreading, Complex Phishing Campaign Installs RATs
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Over 300 entities hit by a variant of Atomic macOS Stealer in recent campaign
Macs under attack from dangerous new info-stealing malware — how to stay safe | Tom's Guide
Fake macOS Help Sites Seek to Spread Infostealer in Targeted Campaign - Infosecurity Magazine
Chinese Developer Jailed for Deploying Malicious Code at US Company - Infosecurity Magazine
The hidden threat in enterprise security: why it’s time to rethink PDFs | TechRadar
TamperedChef Malware Disguised as Fake PDF Editors Steals Credentials and Cookies
Hackers Exploit Linux RAR Flaws in Phishing to Deploy VShell Backdoor
Bots/Botnets
GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional Botnets
IoT under siege: The return of the Mirai-based Gayfemboy Botnet
Mobile
New Android Trojan Variant Expands with Ransomware Tactics - Infosecurity Magazine
iPhone Users 20% More Likely to Fall for Scams Than Android, Study Shows
Anatsa Android Banking Trojan Now Targeting 830 Financial Apps - SecurityWeek
Hook Android Trojan Delivers Ransomware-Style Attacks
Google Deletes Millions of Android Apps After Malware Discovery
Threat Actors Adapting Android Droppers Even to Deploy Simple Malware to Stay Future-Proof
Google to Verify All Android Developers in 4 Countries to Block Malicious Apps
Android.Backdoor.916.origin malware targets Russian business executives
New Android malware poses as antivirus from Russian intelligence agency
Denial of Service/DoS/DDoS
Global DDoS attacks exceed 8M amid geopolitical tensions
Telco DDoS threat on the rise amid geopolitical unrest | TelecomTV
Arch Linux remains under attack as DDoS enters week 2 - here's a workaround | ZDNET
Internet of Things – IoT
IoT under siege: The return of the Mirai-based Gayfemboy Botnet
Camera Hacking — America’s Cyber Defense Agency Issues Warning
Cyberterrorism and the Connected Car: The Growing Threat To Automotive Security | SC Media UK
IoT security challenges, issues and best practices - Security Boulevard
The Risk of Consumer Devices in the Hybrid Workforce
Security researcher maps hundreds of TeslaMate servers spilling Tesla vehicle data | TechCrunch
Data Breaches/Leaks
Human risk and Gen AI-driven data loss top CISO concerns - BetaNews
Google Breach Exposes 2.5 Billion Gmail Accounts to Phishing Attacks
Data Breach Strikes Criminal Records Service Firm APCS | SC Media UK
74% of companies admit insecure code caused a security breach | IT Pro
Google warns Salesloft breach impacted some Workspace accounts
1,000+ Devs Lose Their Secrets to an AI-Powered Stealer
89 Million Steam Accounts Compromised: Change Your Password Now - Security Boulevard
Farmers Insurance data breach impacts 1.1M people after Salesforce attack
Auchan retailer data breach impacts hundreds of thousands of customers
Tencent Cloud leaves critical data open for months | Cybernews
IT system supplier cyberattack impacts 200 municipalities in Sweden
MoD staff were warned not to share hidden data before Afghan leak - BBC News
TransUnion says hackers stole 4.4 million customers' personal information | TechCrunch
Nissan confirms design studio data breach claimed by Qilin ransomware
iiNet Data Breach Exposes 280,000 Customers' Emails and Addresses
Church of England abuse victims exposed by lawyer's email • The Register
90K exposed after sleep therapy provider data breach | Cybernews
Security researcher maps hundreds of TeslaMate servers spilling Tesla vehicle data | TechCrunch
Organised Crime & Criminal Actors
Dark Reading Confidential: Guided Tour of the Dark Web
FBI, Dutch cops seize fake ID marketplace, servers • The Register
A hacker used AI to automate an ‘unprecedented’ cybercrime spree, Anthropic says – DataBreaches.Net
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Crypto Companies Freeze $47m in Romance Baiting Funds - Infosecurity Magazine
Insider Risk and Insider Threats
Human risk and Gen AI-driven data loss top CISO concerns - BetaNews
How social engineering is the weakest link in cyber defence
Chinese Developer Jailed for Deploying Malicious Code at US Company - Infosecurity Magazine
Treasury sanctions North Korea IT worker scheme facilitators and front organizations | CyberScoop
Can We Really Eliminate Human Error in Cybersecurity? - Security Boulevard
When ransomware hits home: putting your people first | TechRadar
Building Human Firewalls: Key to Combating Cyber Threats
Another US Navy Sailor Was Just Busted Spying for China - The National Interest
Insurance
Cyber Insurers May Limit Payouts for Breaches via Flaws
Cyber Outlook Report Finds Gaps, Outlines Holistic Approach to Protections
Cyber insurance still has a problem with modelling - Tech Monitor
Supply Chain and Third Parties
Murky Panda hackers exploit cloud trust to hack downstream customers
5 Practices to Ensure Your Ecosystem Is Cyber-Secure
IT system supplier cyberattack impacts 200 municipalities in Sweden
Ransomware Gangs Are Bleeding the Healthcare Supply Chain | MSSP Alert
When Partners Become Cybersecurity Risks
Cloud/SaaS
Murky Panda hackers exploit cloud trust to hack downstream customers
Ransomware Actor Deletes Data and Backups Post-Exfiltration on Azure - Infosecurity Magazine
Silk Typhoon Attacks North American Orgs in the Cloud
Tencent Cloud leaves critical data open for months | Cybernews
Fake IT Support Attacks Hit Microsoft Teams - Infosecurity Magazine
Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Attackers Abuse Virtual Private Servers to Compromise SaaS Accounts - Infosecurity Magazine
Rising Cloud Security Threats: Exploits, Breaches, and Defenses
ScreenConnect admins targeted with spoofed login alerts - Help Net Security
AWS Trusted Advisor Tricked Into Showing Unprotected S3 Buckets as Secure - SecurityWeek
Online PDF Editors Safe to Use? Detailed Analysis of Security Risks Associated With It
Outages
Microsoft working on fix for ongoing Outlook email issues
Identity and Access Management
Compromised at the Core: Why Identity Remains Cyber’s Biggest Flaw | SC Media UK
Report declares 'identity crisis' amid rising login attacks • The Register
Identity Security Silos: An Attacker's Best Ally
Encryption
Quantum Computing Threatens Encryption: Shift to Post-Quantum Crypto
Linux and Open Source
Arch Linux remains under attack as DDoS enters week 2 - here's a workaround | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
Compromised at the Core: Why Identity Remains Cyber’s Biggest Flaw | SC Media UK
Hackers Can Exfiltrate Windows Secrets and Credentials Silently by Evading EDR Detection
Report declares 'identity crisis' amid rising login attacks • The Register
Billions of Gmail users advised to change passwords | The Independent
Enterprise passwords becoming even easier to steal and abuse | CSO Online
Everyone should know which passwords suck. Do you? | PCWorld
89 Million Steam Accounts Compromised: Change Your Password Now - Security Boulevard
Password managers vulnerable: 40 million users at risk of stolen data | PCWorld
Social Media
Meta might be secretly scanning your phone's camera roll - how to check and turn it off | ZDNET
Social media apps that aggressively harvest user data - Help Net Security
Regulations, Fines and Legislation
CIISec: Most Security Professionals Want Stricter Regulations - Infosecurity Magazine
Cybersecurity Obligations Under EU NIS 2 Directive
Regulatory compliance: Act now | TechRadar
FCC Bars China from Undersea Cables to Combat Espionage Risks
ENISA to manage €36M EU Cybersecurity Reserve ...
4chan will refuse to pay daily UK fines, its lawyer tells BBC
Gaps in California Privacy Law: Brokers Ignore Requests
Apple warns UK against introducing tougher tech regulation - BBC News
Non-Compliance with CMMC Could Put Your DoD Contracts at Risk | Offit Kurman - JDSupra
Models, Frameworks and Standards
Cybersecurity Obligations Under EU NIS 2 Directive
ENISA to manage €36M EU Cybersecurity Reserve ...
NIST Releases Control Overlays to Manage Cybersecurity Risks in Use and Developments of AI Systems
Regulatory compliance: Act now | TechRadar
Hungary extends cybersecurity registration obligations for entities falling under NIS2
ENISA to Coordinate €36m EU-Wide Incident Response Scheme - Infosecurity Magazine
Beyond GDPR security training: Turning regulation into opportunity
Non-Compliance with CMMC Could Put Your DoD Contracts at Risk | Offit Kurman - JDSupra
Data Protection
Gaps in California Privacy Law: Brokers Ignore Requests
Careers, Working in Cyber and Information Security
83% of CISOs say staff shortage is major issue for defense | CSO Online
The Career Delta: Navigating AI, Cybersecurity and Change
Cybersecurity Workforce Trends in 2025 - Skills Gap, Diversity and SOC Readiness
Law Enforcement Action and Take Downs
Interpol cybercrime crackdown in Africa leads to the arrest of over 1,200 suspects - ABC News
Operation Serengeti 2.0: INTERPOL nabs 1,209 cybercriminals in Africa, seizes $97M
FCC removes 1,200 voice providers from telephone networks in major robocall crackdown | CyberScoop
FBI, Dutch cops seize fake ID marketplace, servers • The Register
Yemen Cyber Army hacker jailed after stealing millions of people’s data • Graham Cluley
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
FCC Bars China from Undersea Cables to Combat Espionage Risks
Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Nation State Actors
How Boards Can Prepare for Increasing Nation-State Cyber Threats
China
Murky Panda hackers exploit cloud trust to hack downstream customers
Chinese Hackers Murky, Genesis, and Glacial Panda Escalate Cloud and Telecom Espionage
Silk Typhoon Attacks North American Orgs in the Cloud
UK and 12 allies issue warning over Chinese cyber attacks on ‘critical sectors’ | The Standard
Global Salt Typhoon hacking campaigns linked to Chinese tech firms
Global DDoS attacks exceed 8M amid geopolitical tensions
Telco DDoS threat on the rise amid geopolitical unrest | TelecomTV
Chinese Telecom Hackers Strike Worldwide - GovInfoSecurity
Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide
Another US Navy Sailor Was Just Busted Spying for China - The National Interest
Silk Typhoon hackers hijack network captive portals in diplomat attacks
Chinese Developer Jailed for Deploying Malicious Code at US Company - Infosecurity Magazine
FCC Bars China from Undersea Cables to Combat Espionage Risks
Russia
Putin’s New Cyber Empire | Foreign Affairs
US DoD reportedly relies on utility written by Russian • The Register
New Android malware poses as antivirus from Russian intelligence agency
Android.Backdoor.916.origin malware targets Russian business executives
North Korea
Treasury sanctions North Korea IT worker scheme facilitators and front organizations | CyberScoop
Tools and Controls
Tabletop drills cut cyber event likelihood by 13% – report - CIR Magazine
Compromised at the Core: Why Identity Remains Cyber’s Biggest Flaw | SC Media UK
Hackers Can Exfiltrate Windows Secrets and Credentials Silently by Evading EDR Detection
Ransomware Actor Deletes Data and Backups Post-Exfiltration on Azure - Infosecurity Magazine
Cyber Insurers May Limit Payouts for Breaches via Flaws
Cyber insurance still has a problem with modelling - Tech Monitor
74% of companies admit insecure code caused a security breach | IT Pro
Cyber security response rising up the agenda
Public sector cyber leaders are tired of clunky, outdated tools | IT Pro
Surge in coordinated scans targets Microsoft RDP auth servers
ENISA to Coordinate €36m EU-Wide Incident Response Scheme - Infosecurity Magazine
Report declares 'identity crisis' amid rising login attacks • The Register
Attackers Abuse Virtual Private Servers to Compromise SaaS Accounts - Infosecurity Magazine
The do’s and don’ts of vibe coding - Fast Company
10 common file-sharing security risks and how to prevent them | TechTarget
Identity Security Silos: An Attacker's Best Ally
AWS Trusted Advisor Tricked Into Showing Unprotected S3 Buckets as Secure - SecurityWeek
1,000+ Devs Lose Their Secrets to an AI-Powered Stealer
Why SIEM Rules Fail and How to Fix Them: Insights from 160 Million Attack Simulations
How Bug Bounty Programs Can Help Combat Ransomware Attacks - The Daily Upside
Password managers vulnerable: 40 million users at risk of stolen data | PCWorld
Other News
Nevada state offices close after wide-ranging 'network security incident' | Reuters
Public sector cyber leaders are tired of clunky, outdated tools | IT Pro
Mastercard: How cybersecurity is changing everything
Surge in coordinated scans targets Microsoft RDP auth servers
Why satellite cybersecurity threats matter to everyone - Help Net Security
Space assets are under silent siege. Cybersecurity can’t be an afterthought - SpaceNews
The energy sector has no time to wait for the next cyberattack - Help Net Security
Maritime cybersecurity is the iceberg no one sees coming - Help Net Security
Vulnerability Management
Cyber Insurers May Limit Payouts for Breaches via Flaws
74% of companies admit insecure code caused a security breach | IT Pro
AI Security Map: Linking AI vulnerabilities to real-world impact - Help Net Security
Microsoft Delays Windows 10 Extended Security Updates Rollout
How Bug Bounty Programs Can Help Combat Ransomware Attacks - The Daily Upside
Vulnerabilities
Over 28,000 Citrix instances remain exposed to critical RCE flaw CVE-2025-7775
Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide
ReVault Flaw Exposed Millions of Dell Laptops
CISA Adds Three Exploited Vulnerabilities to KEV Catalog Affecting Citrix and Git
Docker Desktop on Windows contains a critical flaw | Cybernews
Microsoft Delays Windows 10 Extended Security Updates Rollout
Docker fixes critical Desktop flaw allowing container escapes
Organizations Warned of Exploited Git Vulnerability - SecurityWeek
Researchers warn of security flaws in AI-powered browsers | TechSpot
300k+ Plex Media Server instances still vulnerable to attack via CVE-2025-34158 - Help Net Security
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 22 August 2025
Black Arrow Cyber Threat Intelligence Briefing 22 August 2025:
-85% of Organisations Approach Cyber Security Reactively
-25% of Security Leaders Replaced After Ransomware Attack
-Iranian Threat Actor Group ‘MuddyWater’ Targeting CFOs Worldwide
-Canadian Financial Regulator Hacked, Exposing Personal Data from Member Organisations
-‘Impersonation as a Service’ the Next Big Thing in Cybercrime
-URL-Based Threats Become a Go-To Tactic for Cybercriminals
-How Evolving Remote Access Trojans (RATs) Are Redefining Enterprise Security Threats
-How GenAI Complacency is Becoming Cyber Security’s Silent Crisis
-Fake Employees Pose Real Security Risks
-AI Gives Ransomware Gangs a Deadly Upgrade
-DORA: Six Months into a Resilience Revolution
-Why Your Security Culture is Critical to Mitigating Cyber Risk
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
This week we start with a look at how organisations react to cyber incidents: studies show that most organisations prioritise their security after they have been attacked, and one in four CISOs lose their job after a ransomware attack even when the incident stems from factors outside their direct control. We discuss emerging attacks, including those focused on CFOs and Regulators, and where English language speakers are hired to help in social engineering attacks. We also spotlight attacks using remote access trojans, and the risks of complacency when using AI while AI itself continues to boost attackers.
Looking ahead, Gartner warns that by 2028 up to one in four job candidates could be artificially generated with associated security risks. Focusing on solutions to address cyber risks, we look at the impact of the EU’s DORA law that aims to build better resilience in the financial services sector. Finally, on the basis that the majority of cyber attacks involve people, including the social engineering attacks referred to earlier, we look at how a security culture is critical to helping to protect your organisation.
Top Cyber Stories of the Last Week
85% of Organisations Approach Cyber Security Reactively
Unisys has found that 85% of organisations still approach cyber security reactively, responding only after an incident has occurred. While 62% have adopted or plan to adopt zero trust models, fewer than half use artificial intelligence to strengthen defences. Most acknowledge they are not prepared for future threats such as quantum-enabled attacks. The consequences are costly, with nearly half estimating downtime expenses of at least $500,000 per hour. The findings highlight the urgent need for a proactive and layered security strategy that combines advanced technology with strong human oversight.
25% of Security Leaders Replaced After Ransomware Attack
A new Sophos report has revealed that one in four security leaders lose their role following a ransomware attack, regardless of whether they were directly at fault. The findings highlight growing board-level frustration when security measures fail, even if breaches stem from business decisions outside the CISO’s authority. The study found that email-based attacks (malicious and phishing) were the leading cause of 37% of incidents, while exploited system weaknesses were the leading cause in 32% of cases, followed by stolen passwords in 23%. The report warns that many incidents arise from known gaps that were left unaddressed, making leadership accountability a critical issue.
Iranian Threat Actor Group ‘MuddyWater’ Targeting CFOs Worldwide
A new cyber espionage campaign linked to the group known as MuddyWater is targeting Chief Financial Officers and finance leaders worldwide. The attackers use highly convincing phishing emails that mimic recruitment messages, tricking victims into completing fake verification challenges before delivering malicious files. Once inside, they install legitimate tools such as OpenSSH and NetBird to create hidden backdoors, enable remote access, and even set up secret administrator accounts. This approach gives the attackers long term access while avoiding detection, highlighting the increasing sophistication of threats aimed directly at senior financial executives.
https://cybersecuritynews.com/apt-muddywater-attacking-cfos/
Canadian Financial Regulator Hacked, Exposing Personal Data from Member Organisations
The Canadian Investment Regulatory Organisation (CIRO) has disclosed a cyber security breach that exposed personal data from some member firms and their employees. The regulator detected the attack on 11 August and temporarily shut down systems to protect operations while an investigation was launched with external experts and law enforcement. Although investor funds were not affected, the incident raises concern given CIRO’s role in overseeing Canada’s investment and trading firms. CIRO has committed to notifying affected individuals, offering risk mitigation services, and warning members to be alert to fraudulent calls or emails pretending to be the regulator.
https://www.infosecurity-magazine.com/news/canadian-financial-regulator-hacked/
‘Impersonation as a Service’ the Next Big Thing in Cybercrime
Criminal groups are increasingly offering “impersonation as a service,” where skilled English-speaking fraudsters are hired to trick employees into handing over access to company systems. Reports show such roles being advertised on underground forums have more than doubled since 2024, signalling that targeted social engineering attacks are set to rise. Recent incidents have seen attackers exploit trust through convincing phone calls to breach major firms including Google, Dior, and Allianz. Combined with advances in artificial intelligence and collaboration between criminal groups, this trend represents a growing and highly professionalised threat to businesses worldwide.
https://www.theregister.com/2025/08/21/impersonation_as_a_service/
URL-Based Threats Become a Go-To Tactic for Cybercriminals
Proofpoint has reported that cyber criminals are increasingly favouring malicious links over attachments, with URL-based threats now four times more common than file-based attacks. In the first half of 2025 alone, more than 3.7 billion attempts were made to steal user logins through phishing, and QR code scams exceeded 4.2 million cases. Smishing, or text-based phishing, has surged by more than 2,500%, showing a clear shift towards targeting mobile devices. These campaigns often mimic trusted brands or government services, making them difficult for people to recognise and highlighting the need for stronger human-focused cyber security measures.
https://www.helpnetsecurity.com/2025/08/21/phishing-url-based-threats/
How Evolving Remote Access Trojans (RATs) Are Redefining Enterprise Security Threats
Remote access trojans or RATs (malware that gives attackers full control of a victim’s computer) are becoming more sophisticated, using everyday tools and file formats to avoid detection while maintaining long-term access to systems. Recent attacks have shown how criminals use phishing emails, built-in Windows functions, and even artificial intelligence to launch stealthy campaigns that can quietly steal sensitive data for weeks. Traditional security approaches that rely on signatures or isolated defences are proving inadequate. Experts recommend a shift to behaviour-based monitoring that links endpoint, network, and identity activity, helping organisations detect unusual patterns earlier and limit the damage caused by these evolving threats.
How GenAI Complacency is Becoming Cyber Security’s Silent Crisis
Organisations are increasingly adopting Generative AI tools such as ChatGPT, Gemini and Copilot, with 42% already deploying them and a further 40% experimenting. While these tools drive efficiency, they have also created a culture of complacency that masks significant security risks. By 2027, over 40% of data breaches are expected to stem from improper AI use, often linked to employees unintentionally exposing sensitive data. The report highlights that without clear policies, training and continuous monitoring, firms risk leaving blind spots open to exploitation. Leadership must act now to balance AI innovation with robust security governance.
https://www.techradar.com/pro/how-genai-complacency-is-becoming-cybersecuritys-silent-crisis
Fake Employees Pose Real Security Risks
Gartner warns that by 2028 up to one in four job candidates could be artificially generated, posing major risks for organisations. Fake employees, often linked to fraudsters or hostile states, have already cost companies millions and in some cases enabled the theft of digital assets worth hundreds of thousands of dollars. The threat is most severe when these individuals gain IT roles with privileged access, giving them control over critical systems. Experts stress that prevention requires a mix of recruiter training, stronger access governance, and automated monitoring to detect suspicious behaviour before damage is done.
https://www.darkreading.com/cyberattacks-data-breaches/fake-employees-pose-real-security-risks
AI Gives Ransomware Gangs a Deadly Upgrade
Ransomware remains the leading cyber threat to businesses, with attacks rising 70% in early 2025 compared to previous years. Criminal groups are increasingly using artificial intelligence to automate attacks, launch convincing phishing campaigns, and even create deepfake impersonations of executives. While some attack volumes slowed in the second quarter due to law enforcement action and stronger defences, industries such as manufacturing, retail, and technology remain heavily targeted. Managed service providers are also under sustained attack, with phishing now accounting for over half of incidents. AI tools are making advanced attack methods widely available, lowering barriers for criminals.
https://www.helpnetsecurity.com/2025/08/22/ransomware-gangs-ai/
DORA: Six Months into a Resilience Revolution
Six months after its introduction, the EU’s Digital Operational Resilience Act (DORA) has already reshaped the financial sector, requiring firms to embed stronger controls across technology, risk, and third-party management. Nearly half of firms reported costs exceeding one million euros, while stress and workload have increased significantly for senior leaders and staff. Organisations have focused on improving risk management, reporting incidents quickly, and carrying out resilience testing that simulates real-world cyber attacks. Vendor oversight has also become a central priority, with firms demanding more assurance from suppliers. Although costly, these efforts are seen as investments to protect reputation, continuity, and long-term resilience.
https://www.techradar.com/pro/dora-six-months-into-a-resilience-revolution
Why Your Security Culture is Critical to Mitigating Cyber Risk
Research shows that nearly 60% of breaches in 2024 involved a human element, underlining that people, not just technology, are the main target for attackers. The problem is not that employees do not care about security, but that security measures are often overly complex, poorly designed, or disconnected from daily work. A strong security culture, shaped by leadership, supportive security teams, clear policies, and relevant training, is essential. Without embedding security into the way people work, even the most advanced technical defences will continue to be undermined.
https://thehackernews.com/2025/08/why-your-security-culture-is-critical.html
Governance, Risk and Compliance
25% of security leaders replaced after ransomware attack | CSO Online
Weak alerting and slipping prevention raise risk levels for CISOs - Help Net Security
Why Your Security Culture is Critical to Mitigating Cyber Risk
UK firms at risk of more cyber incidents - here's how to stay protected | TechRadar
85% of Organizations Approach Cybersecurity Reactively | Security Magazine
C-Suite Lessons From Joe Sullivan And The Uber Data Breach
Employee distraction is a bigger risk than attack sophistication - BetaNews
UK cyber leaders feel impact of Trump cutbacks | Computer Weekly
Threats
Ransomware, Extortion and Destructive Attacks
25% of security leaders replaced after ransomware attack | CSO Online
Ransomware is on the rise: Global cybercrime hits new highs - Digital Journal
February ransomware attacks hit record high as ThreatDown reports 25% annual surge - SiliconANGLE
Teen hackers aren't the problem. They're the wake-up call | Computer Weekly
AI gives ransomware gangs a deadly upgrade - Help Net Security
Can cyber group takedowns last? | IT Pro
Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware
Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware | Trend Micro (US)
Insurers face challenges with UK ransomware ban
Europol Says Qilin Ransomware Reward Fake - SecurityWeek
Europe's Ransomware Surge Is a Warning Shot for US Defenders
U.S. Sanctions Garantex and Grinex Over $100M in Ransomware-Linked Illicit Crypto Transactions
U.S. seizes $2.8 million in crypto from Zeppelin ransomware operator
Ransomware Victims
Warlock claims ransomware attack on network services firm Colt | Computer Weekly
Colt Telecom attack claimed by WarLock ransomware, data up for sale
Accounting Firm Pays Feds $175K for HIPAA Ransomware Breach
Ransomware attack at DaVita impacted 2.7 million people, US health dept website shows - CNA
Phishing & Email Based Attacks
Phishing Campaign Exploits Microsoft ADFS to Evade Security
APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task
Hackers steal Microsoft logins using legitimate ADFS redirects
2.5 billion Gmail users at risk after Google's databases were hacked | PCWorld
URL-based threats become a go-to tactic for cybercriminals - Help Net Security
Study: Phishing always works, despite cyber training | Cybernews
Nearly half of Americans still reuse passwords despite phishing risks - BetaNews
Warning: Watch Out for This Japanese Character in Your Booking.com Email
Cybercriminals Attack VPS to Access Business Email Systems | Security Magazine
Scam Emails Are Getting Smarter—Would You Fall for These Ones?
Other Social Engineering
North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker Scheme Hits 320+ Firms
Fake Employees Pose Real Security Risks
Zero-day Clickjacking exploit impacts several password managers - gHacks Tech News
Fake It Til You Make It: The New Age of Employment Fraud | MSSP Alert
URL-based threats become a go-to tactic for cybercriminals - Help Net Security
Hackers Weaponize QR Codes in New ‘Quishing’ Attacks - Infosecurity Magazine
Cybercriminals Deploy CORNFLAKE.V3 Backdoor via ClickFix Tactic and Fake CAPTCHA Pages
Beyond romance fraud: The rising threat of social media scams | TechRadar
'Impersonation as a service' next big thing in cybercrime • The Register
Workday Confirms Social Engineering Cyberattack Exposing Contact Data
Workday Breach Linked to ShinyHunters Salesforce Attacks
Massive Allianz Life data breach impacts 1.1 million people
Workday Discloses Data Breach Following CRM-Targeted Social Engineering Attack - IT Security Guru
Scam Emails Are Getting Smarter—Would You Fall for These Ones?
Scammers Are Now Impersonating Cyber Crime Agents
Fraud, Scams and Financial Crime
Fake It Til You Make It: The New Age of Employment Fraud | MSSP Alert
Beyond romance fraud: The rising threat of social media scams | TechRadar
Authorized Push Payment Fraud a National Security Risk to UK - Infosecurity Magazine
Scam Emails Are Getting Smarter—Would You Fall for These Ones?
WhatsApp Privacy Myths: Encryption Flaws, Scams, and Signal Alternatives
Scammers Are Now Impersonating Cyber Crime Agents
Experts Warn Athletes Against Public Venmo Accounts
Artificial Intelligence
How GenAI complacency is becoming cybersecurity’s silent crisis | TechRadar
Fake It Til You Make It: The New Age of Employment Fraud | MSSP Alert
Fake Employees Pose Real Security Risks
AI gives ransomware gangs a deadly upgrade - Help Net Security
4 in 5 CISOs say DeepSeek must be regulated - Data Centre & Network News
URL-based threats become a go-to tactic for cybercriminals - Help Net Security
Man-in-the-Prompt: The invisible attack threatening ChatGPT and other AI systems
This Authentication Method Is Horribly Insecure—AI Just Made It Worse
The era of AI hacking has arrived
CISOs need to think about risks before rushing into AI - Help Net Security
Hackers Abuse Vibe Coding Service to Build Malicious Sites
Easy ChatGPT Downgrade Attack Undermines GPT-5 Security
New NIST guide explains how to detect morphed images - Help Net Security
Scammers are sneaking into Google's AI summaries to steal from you - how to spot them | ZDNET
How web scraping actually works - and why AI changes everything | ZDNET
Microsoft mum about M365 Copilot on-demand security bypass • The Register
Claude can now stop conversations - for its own protection, not yours | ZDNET
Hundreds of thousands of Grok chats exposed in Google results - BBC News
Perplexity's Comet AI browser could expose your data to attackers - here's how | ZDNET
Agentic AI’s security risks are challenging, but the solutions are surprisingly simple | TechRadar
The invisible battlefield: Good AI vs Bad AI in the evolving cybersecurity landscape | TechRadar
Malware
How Evolving RATs Are Redefining Enterprise Security Threats
Cybercriminals Deploy CORNFLAKE.V3 Backdoor via ClickFix Tactic and Fake CAPTCHA Pages
Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware
Budget Mac.c Infostealer Rivals AMOS Amid 101% macOS Threat Surge
New FireWood Malware Attacking Linux Systems to Execute Commands and Exfiltrate Sensitive Data
XenoRAT malware campaign hits multiple embassies in South Korea
USB Malware Campaign Spreads Cryptominer Worldwide - Infosecurity Magazine
Popular npm Package Compromised in Phishing Attack - Infosecurity Magazine
Legitimate Chrome VPN Extension Turns to Browser Spyware - Infosecurity Magazine
New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Code
Hundreds Targeted in New Atomic macOS Stealer Campaign - SecurityWeek
Developer jailed for malware that took out his employer • The Register
“Rapper Bot” malware seized, alleged developer identified and charged
Solana malware targeting Russian crypto developers • The Register
Mobile
UK backs down in Apple privacy row, US says - BBC News
Android VPN apps used by millions are covertly connected AND insecure - Help Net Security
Apple Patches CVE-2025-43300 Zero-Day in iOS, iPadOS, and macOS Exploited in Targeted Attacks
Apple addressed the seventh actively exploited zero-day
Novel 5G Attack Bypasses Need for Malicious Base Station - SecurityWeek
ERMAC Android malware source code leak exposes banking trojan infrastructure
How To Find And Remove Spyware From Your Android Phone
Denial of Service/DoS/DDoS
Internet-wide Vulnerability Enables Giant DDoS Attacks
“Rapper Bot” malware seized, alleged developer identified and charged
'Rapper Bot' hit the Pentagon in at least 3 cyberattacks | DefenseScoop
Internet of Things – IoT
Hackers can abuse IPv6 to hijack networks | Cybernews
System Shocks? EV Smart Charging Tech Poses Cyber-Risks
Your smart home device just got a performance and security boost for free | ZDNET
Data Breaches/Leaks
2.5 billion Gmail users at risk after Google's databases were hacked | PCWorld
Over 190 million hit in UnitedHealth data breach — confirmed largest in history | Tom's Guide
Hacker Offers to Sell 15.8 Million Plain-Text PayPal Credentials On Dark Web Forum
Canadian Financial Regulator Hacked, Exposing Personal Data from Membe - Infosecurity Magazine
Workday Confirms Social Engineering Cyberattack Exposing Contact Data
Air France and KLM warn customers of new data breach | Fox News
4 cyberattacks that rocked global telecoms | Capacity Media
Dozens more Afghan relocation data breaches uncovered by BBC - BBC News
Colt Telecom attack claimed by WarLock ransomware, data up for sale
Millions Allegedly Affected in Allianz Insurance Breach
Orange Belgium's 850K mega-breach raises fraud fears • The Register
Elon Musk’s xAI Published Hundreds Of Thousands Of Grok Chatbot Conversations
Intel Employee Data Exposed by Vulnerabilities - SecurityWeek
Australian ISP iiNet Suffers Breach of 280,000+ Records - Infosecurity Magazine
TPG Telecom estimates 280K affected by subsidiary breach • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
USB Malware Campaign Spreads Cryptominer Worldwide - Infosecurity Magazine
Lazarus strikes again? $23m theft topples crypto platform
Lykke Exchange Shuts Down After $23M Lazarus Group Hack
US seizes $2.8 million in crypto from Zeppelin ransomware operator
Nebraska man gets 1 year in prison for $3.5M cryptojacking scheme
Solana malware targeting Russian crypto developers • The Register
Insider Risk and Insider Threats
Fake It Til You Make It: The New Age of Employment Fraud | MSSP Alert
Fake Employees Pose Real Security Risks
North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker Scheme Hits 320+ Firms
Study: Phishing always works, despite cyber training | Cybernews
Developer jailed for malware that took out his employer • The Register
Soldier admits handing over sensitive information to person he thought was foreign agent | RNZ News
Insurance
Insurers face challenges with UK ransomware ban
Is personal cyber insurance at an inflection point? - Insurance Post
Cloud/SaaS
Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems
Microsoft investigates outage impacting Copilot, Office.com
Outages
Microsoft investigates outage impacting Copilot, Office.com
Colt Customers Face Prolonged Outages After Major Cyber Incident - Infosecurity Magazine
Identity and Access Management
Phishing Campaign Exploits Microsoft ADFS to Evade Security
Hackers steal Microsoft logins using legitimate ADFS redirects
Encryption
UK Backs Down On Apple Encryption Backdoor—But The Secret Deal Raises New Questions | Techdirt
US spy chief Gabbard says UK agreed to drop 'backdoor' mandate for Apple | Reuters
An explanation of quantum key distribution | TechTarget
Trump admin says it convinced UK to drop demand for Apple backdoor - Ars Technica
UK Drops Demand for iCloud Backdoor for American Users' Data
FTC warns US Big Tech: Don’t bend to foreign censors • The Register
WhatsApp Privacy Myths: Encryption Flaws, Scams, and Signal Alternatives
Russia Is Cracking Down on End-to-End Encrypted Calls | WIRED
Linux and Open Source
Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems
New FireWood Malware Attacking Linux Systems to Execute Commands and Exfiltrate Sensitive Data
Passwords, Credential Stuffing & Brute Force Attacks
Nearly half of Americans still reuse passwords despite phishing risks - BetaNews
Zero-day Clickjacking exploit impacts several password managers - gHacks Tech News
Password Managers Vulnerable to Data Theft via Clickjacking - SecurityWeek
Social Media
Beyond romance fraud: The rising threat of social media scams | TechRadar
Training, Education and Awareness
Study: Phishing always works, despite cyber training | Cybernews
Employee distraction is a bigger risk than attack sophistication - BetaNews
Almost all banks mandate cyber security training - Risk.net
Regulations, Fines and Legislation
US spy chief Gabbard says UK agreed to drop 'backdoor' mandate for Apple | Reuters
The UK Online Safety Act could kill the internet as we know it.
DORA: six months into a resilience revolution | TechRadar
Trump admin says it convinced UK to drop demand for Apple backdoor - Ars Technica
FTC warns US Big Tech: Don’t bend to foreign censors • The Register
UK Backs Down On Apple Encryption Backdoor—But The Secret Deal Raises New Questions | Techdirt
Insurers face challenges with UK ransomware ban
EU: ENISA Guidelines on Compliance with NIS 2 Directive Published | DLA Piper - JDSupra
EU’s Cyber Resilience Act: As Deadline Looms, Are You Ready For It? - EE Times
How VPNs are helping people evade increased censorship - and much more | ZDNET
UK cyber leaders feel impact of Trump cutbacks | Computer Weekly
The EU NIS2 Directive and intra-group IT services | Hogan Lovells - JDSupra
UK cyber leaders feel impact of Trump cutbacks | Computer Weekly
Mozilla warns Germany could soon declare ad blockers illegal
Regulator rebukes Nova Scotia Power's request for secrecy in cybersecurity inquiry | CBC News
Election workers fear 2026 threats without feds' support • The Register
By gutting its cyber staff, State Department ignores congressional directives | CyberScoop
Bill would give hackers letters of marque against US enemies • The Register
Models, Frameworks and Standards
DORA: six months into a resilience revolution | TechRadar
EU’s Cyber Resilience Act: As Deadline Looms, Are You Ready For It? - EE Times
The EU NIS2 Directive and intra-group IT services | Hogan Lovells - JDSupra
New NIST guide explains how to detect morphed images - Help Net Security
Accounting Firm Pays Feds $175K for HIPAA Ransomware Breach
Careers, Working in Cyber and Information Security
Would you hire a hacker? | Computer Weekly
Building a New Generation of Security Talent Amid an Escalating Cyber - Infosecurity Magazine
Cyber teams are struggling to keep up with a torrent of security alerts | IT Pro
Law Enforcement Action and Take Downs
Developer jailed for malware that took out his employer • The Register
US seizes $2.8 million in crypto from Zeppelin ransomware operator
Can cyber group takedowns last? | IT Pro
Nebraska man gets 1 year in prison for $3.5M cryptojacking scheme
US cops seize mega DDoS-for-hire racket RapperBot • The Register
A hacker tied to Yemen Cyber Army gets 20 months in prison
'Rapper Bot' hit the Pentagon in at least 3 cyberattacks | DefenseScoop
Serial hacker who defaced official websites is sentenced - National Crime Agency
Israeli government official arrested in Nevada sex crimes operation | The Independent
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task
Russia-linked gang using Cisco devices for spying | Cybernews
FBI, Cisco Warn of Russian Attacks on 7-Year Flaw
FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage
Nation State Actors
Swap Around and Find Out: The New Rules of International Digital Economic Warfare – War on the Rocks
China
CrowdStrike warns of uptick in Silk Typhoon attacks this summer | CyberScoop
4 in 5 CISOs say DeepSeek must be regulated - Data Centre & Network News
Microsoft scales back Chinese access to cyber early warning system
China labels US as 'surveillance empire' over chip tracking • The Register
Chinese hackers are targeting web hosting firms - here's what we know | TechRadar
Microsoft restricts Chinese firms over hacking fears | Windows Central
Chinese APT Group Targets Web Hosting Services in Taiwan - Infosecurity Magazine
China cut itself off from the global internet on Wednesday • The Register
DPRK, China Suspected in South Korean Embassy Attacks
Russia
Russia-linked gang using Cisco devices for spying | Cybernews
Russia Is Cracking Down on End-to-End Encrypted Calls | WIRED
Russian Hacktivists Take Aim at Polish Power Plant, Again
Solana malware targeting Russian crypto developers • The Register
Russian hackers lurked in US courts for years and took sealed files | Stars and Stripes
Russia-linked European attacks renew concerns over water cybersecurity | CSO Online
Russian Hackers Hitting Critical Infrastructure, FBI Warns
Iran
APT MuddyWater Attacking CFOs Leveraging OpenSSH, Enables RDP, and Scheduled Task
Hackers disrupt communications of dozens of Iranian oil and cargo ships | Iran International
North Korea
North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker Scheme Hits 320+ Firms
North Korea's IT worker fraud has fooled nearly every Fortune 500 firm
Lazarus strikes again? $23m theft topples crypto platform
Hackers who exposed North Korean government hacker explain why they did it | TechCrunch
Tools and Controls
Study: Phishing always works, despite cyber training | Cybernews
Cybercriminals Attack VPS to Access Business Email Systems | Security Magazine
Hackers Weaponizing Cisco's Secure Links to Evade Link Scanning and By-Pass Network Filters
Zero-day Clickjacking exploit impacts several password managers - gHacks Tech News
Password Managers Vulnerable to Data Theft via Clickjacking - SecurityWeek
Scans From Hacked Cisco Small Business Routers, Linksys and Araknis are at the Raise
Hackers can abuse IPv6 to hijack networks | Cybernews
McDonald's not lovin' it when hacker exposes rotten security • The Register
Cyber teams are struggling to keep up with a torrent of security alerts | IT Pro
The EU NIS2 Directive and intra-group IT services | Hogan Lovells - JDSupra
Insurers face challenges with UK ransomware ban
Employee distraction is a bigger risk than attack sophistication - BetaNews
Android VPN apps used by millions are covertly connected AND insecure - Help Net Security
This Authentication Method Is Horribly Insecure—AI Just Made It Worse
CISOs need to think about risks before rushing into AI - Help Net Security
Hackers Abuse Vibe Coding Service to Build Malicious Sites
BYOD Evolution: Essential for Hybrid Work Productivity and Security
How VPNs are helping people evade increased censorship - and much more | ZDNET
The Security Vulnerabilities to Watch for When You’re Vibe Coding
The invisible battlefield: Good AI vs Bad AI in the evolving cybersecurity landscape | TechRadar
How to Vibe Code With Security in Mind
Attackers Start Outside: Why MSSPs Should Prioritize External Threat Intelligence | MSSP Alert
Perplexity's Comet AI browser could expose your data to attackers - here's how | ZDNET
Elastic rejects claims of a zero-day RCE flaw in Defend EDR
Is personal cyber insurance at an inflection point? - Insurance Post
Making Pen Testing a Year-Round Cybersecurity Strength | SC Media UK
Solana malware targeting Russian crypto developers • The Register
Other News
Should Europe wean itself off US tech? - BBC News
Hackers can abuse IPv6 to hijack networks | Cybernews
Teen hackers aren't the problem. They're the wake-up call | Computer Weekly
UK firms at risk of more cyber incidents - here's how to stay protected | TechRadar
Aviation Tech Failures Expose Aging Systems and Cyber Risks
Dutch prosecution service attack keeps speed cameras offline • The Register
McDonald's not lovin' it when hacker exposes rotten security • The Register
Teen hacker’s journey: From curiosity to revenge | Cybernews
From medieval stronghold to cyber fortress: shielding Europe’s digital future | Cyprus Mail
Local governments struggle to defend critical infrastructure as threats grow - Help Net Security
How your solar rooftop became a national security issue | TechCrunch
How Outer Space Became the Next Big Attack Surface
UK cyber leaders feel impact of Trump cutbacks | Computer Weekly
Casino outfit Bragg says personal data untouched in attack • The Register
Train Maker Sues Hackers For Exposing Dodgy Efforts To Make Train Repairs More Difficult | Techdirt
What makes airport and airline systems so vulnerable to attack? - Help Net Security
Vulnerability Management
Majority of Organizations Ship Vulnerable Code, Study Finds - Infosecurity Magazine
Attacker “Patches” Vulnerability Post Exploitation to Lock Out Competi - Infosecurity Magazine
Majority of Organizations Ship Vulnerable Code, Study Finds - Infosecurity Magazine
Vulnerabilities
Zero-day Clickjacking exploit impacts several password managers - gHacks Tech News
Researcher to release exploit for full auth bypass on FortiWeb
Microsoft releases emergency updates to fix Windows recovery
FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage
Internet-wide Vulnerability Enables Giant DDoS Attacks
Apple discloses actively exploited zero-day affecting iOS, iPadOS and macOS | CyberScoop
Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware
Warlock: From SharePoint Vulnerability Exploit to Enterprise Ransomware | Trend Micro (US)
Multiple Chrome High-Severity Vulnerabilities Let Attackers Execute Arbitrary Code
U.S. CISA adds Trend Micro Apex One flaw to its Known Exploited Vulnerabilities catalog
Over 800 N-able servers left unpatched against critical flaws
Scans From Hacked Cisco Small Business Routers, Linksys and Araknis are at the Raise
Easy ChatGPT Downgrade Attack Undermines GPT-5 Security
Xerox fixed path traversal and XXE bugs in FreeFlow Core
High-Severity Vulnerabilities Patched in Chrome, Firefox - SecurityWeek
Public Exploit for Chained SAP Flaws Exposes Unpatched Systems to Remote Code Execution
Commvault plugs holes in backup suite that allow remote code execution - Help Net Security
Perplexity's Comet AI browser could expose your data to attackers - here's how | ZDNET
Elastic rejects claims of a zero-day RCE flaw in Defend EDR
Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems
Microsoft Windows 11 24H2 Update May Cause SSD Failures | TechPowerUp
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Alert 18 August 2025 – Microsoft 365 Direct Send abuse enabling internal-appearing phishing
Black Arrow Cyber Alert 18 August 2025 – Microsoft 365 'Direct Send' abuse enabling phishing emails from internal addresses
Executive summary
Security researchers and vendors have confirmed active campaigns abusing Microsoft 365’s Direct Send feature to deliver emails that look like they originate from inside an organisation, without any mailbox compromise or authentication. The messages often utilise Microsoft infrastructure and can bypass external security controls, increasing the likelihood of credential theft and business email compromise. Microsoft has released a control that tenants can enable to reject unauthenticated Direct Send. Additional configuration can prevent direct delivery to the tenant when email records are configured to point to a third party.
What’s the risk to me or my business?
Attackers can send emails that impersonate your own users or departments. Common themes include voicemail or fax alerts and PDFs that contain QR codes leading to credential-harvesting pages. Because delivery uses Microsoft endpoints, messages may appear internal and can evade external filtering paths, undermining user trust and raising the success rate of social engineering and payment fraud.
Increased risk of further exploitation through other vulnerabilities
Successful credential theft enables lateral movement, mailbox rule abuse, internal spear-phishing and financial fraud. Some campaigns inject messages via unsecured third-party relays and VPS infrastructure before final delivery to Microsoft 365, complicating attribution and forensics.
What can I do?
Given active exploitation, immediate action is advised.
If you do not need Direct Send, block it
Enable the organisation setting to reject unauthenticated Direct Send traffic using PowerShell. This blocks anonymous messages where the envelope sender domain matches one of your accepted domains. Test, then monitor for breakage in legacy devices or services.If you need Direct Send, authenticate and restrict it
Create inbound partner connectors and restrict by TLS certificate (preferred) or by approved IP ranges for printers, applications and third-party services that must send as your domain. Where full rejection is not yet possible, use transport rules to quarantine unauthenticated internal-looking mail while you add exceptions for legitimate sources.Prevent direct delivery bypass when MX points to a third party
If your MX is not Exchange Online, configure an inbound connector and set restrictions so only your approved gateway path can deliver to the tenant. This closes the direct-to-tenant path that might otherwise bypass external filtering.Strengthen authentication and policy
Enforce SPF, DKIM and DMARC with a reject policy, and tune anti-spoofing. Treat unauthenticated internal-looking messages as suspicious. Consider transport rules that quarantine them by default.Hunt and monitor
Use Historical Message Trace, Threat Explorer, or Advanced Hunting to identify messages received without an attributed connector. Hunt for unauthenticated internal-looking mail, composite authentication failures and unusual attachment patterns such as PDFs with QR codes.Prepare users
Brief staff that internal-looking emails can be forged. Call out common lures and warn specifically about QR-code attachments. Encourage out-of-band verification for sensitive requests.
Technical Summary
Abuse mechanism
Direct Send allows devices and applications to send to internal recipients without authentication via tenant smart hosts such as tenantname.mail.protection.outlook.com. Threat actors send spoofed messages to those endpoints using internal-looking From addresses, often with scripted SMTP clients.
Observed tactics
Lures frequently mimic voicemail or fax notifications and include PDFs with QR codes that resolve to credential harvesters. Some campaigns relay through unsecured third-party email appliances or VPS infrastructure before final delivery.
Why it lands
Messages traverse Microsoft infrastructure and can be treated as internal, so they may land in inboxes or junk despite composite authentication failures, especially where mail routing is complex or controls are not locked down.
Microsoft controls
Microsoft introduced a tenant-wide Reject Direct Send setting, plus guidance on preventing direct delivery to the tenant and on quarantine-first transport rules for organisations not ready to block.
Activity timeline
Campaigns observed since May 2025, with multiple vendors reporting ongoing abuse through July and August 2025.
Further information
Microsoft Exchange Team: Introducing more control over Direct Send in Exchange Online. Public preview of Reject Direct Send, behaviour and error text. (TECHCOMMUNITY.MICROSOFT.COM)
Microsoft Exchange Team: Direct Send vs sending directly to an Exchange Online tenant. Lockdown patterns, connectors, hunting and quarantine-first rules. (TECHCOMMUNITY.MICROSOFT.COM)
Varonis Threat Labs: Ongoing campaign abusing Direct Send to deliver internal-appearing phishing, with timeline and technique details. (Varonis)
Proofpoint: Attackers abusing M365 for internal phishing, delivery paths via unsecured relays, and recommended mitigations. (Proofpoint)
Mimecast Threat Intelligence: Direct Send abuse overview, observed artefacts and recommendations. (Mimecast)
eSentire Advisory: Direct Send abuse leading to internal phishing, QR-code lures and response guidance. (eSentire)
Barracuda: Securing Microsoft Direct Send, attack summary and guidance. (Barrcuda Blog)
IRONSCALES: Inside Job: attackers spoofing emails with M365 Direct Send, controls to reduce risk. (IRONSCALES)
BleepingComputer: Microsoft 365 Direct Send abused to send phishing as internal users. (BleepingComputer)
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Intelligence Briefing 15 August 2025
Black Arrow Cyber Threat Intelligence Briefing 15 August 2025:
-Over 29,000 Exchange Servers Still Unpatched Against High-Severity Flaw
-Nearly Half of Enterprises Tested Had Easily Cracked Passwords
-Leaked Credentials Up 160% - What Attackers Are Doing With Them
-Ransomware Attacks Up by 41% Globally
-Physical Threats to Crypto Owners Hit Record Highs
-The UK Cyber Governance Code of Practice: Beyond Basic Protections to Culture, Leadership and Training
-The Human Firewall: Building a Cyber-Aware Workforce
-Microsoft Warns Organisations Without a Rehearsed Response Plan Are Hit Harder by a Security Incident
-Attack Yourself First: the Logic Behind Offensive Security
-These Two Ransomware Groups Are Ramping Up Attacks and Have Claimed Hundreds of Victims
-Financial Services Could Be Next in Line for ShinyHunters
-Three Notorious Cybercrime Gangs, Scattered Spider, ShinyHunters and Lapsus$, Appear to Be Collaborating
-Nation State Actor Groups are Getting Personal, Going After Executives in Their Personal Lives
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Executive Summary
We begin with two calls to action for stronger cyber security: ensure your systems are patched to fix vulnerabilities, in this case Microsoft Exchange servers, and ensure your team uses strong passwords. We also report on the ongoing rise in cyber attacks including the increase in ransomware, the use of physical violence in cryptocurrency-related incidents, and changes within the attacker community such as a further shift towards the financial services sector.
To address these and other threats, it is essential to have a clear and objective understanding of your risks, and to counter them through a strategy that encompasses people, operations and technology.
The UK Cyber Governance Code of Practice is a valuable reference, even for organisations outside the UK. It includes two key principles: build strong defences through your employees, and rehearse how your leadership team will respond to an incident. It is also strongly recommended to commission assessments from an attacker’s perspective, to identify and resolve vulnerabilities before they are exploited.
Contact us for impartial specialist advice and support to implement the above in a proportionate and effective manner.
Top Cyber Stories of the Last Week
Over 29,000 Exchange Servers Still Unpatched Against High-Severity Flaw
Over 29,000 Microsoft Exchange servers remain unpatched against a serious flaw that could allow attackers to gain full control of both cloud and on-premises systems in hybrid environments. The vulnerability affects Exchange 2016, 2019 and Subscription Edition, and can be exploited to bypass detection by forging trusted credentials. Despite a fix released in April 2025, scans show large numbers of exposed systems worldwide. US federal agencies have been ordered to apply patches immediately, and all organisations are strongly advised to follow suit to prevent potential domain compromise.
Nearly Half of Enterprises Tested Had Easily Cracked Passwords
Picus Security’s 2025 Blue Report found that nearly half of enterprises tested had at least one easily cracked password, with attacks using valid credentials succeeding 98% of the time. Overall, the ability to block an attack dropped from 69% in 2024 to 62%, while the ability to stop data theft fell to just 3%. Detection weaknesses persisted, with only 14% of simulated attacks triggering alerts. The report urges stronger password policies, improved monitoring for data loss, and testing for ransomware scenarios to strengthen resilience.
Leaked Credentials Up 160% - What Attackers Are Doing With Them
Leaked credentials are a growing driver of cyber breaches, accounting for 22% of incidents in 2024, according to Verizon. Cyberint reports a 160% rise in such leaks in 2025, with many remaining active and exploitable for months. Attackers increasingly use automated tools, infostealer malware, and AI-driven phishing to obtain usernames and passwords, which are then sold or reused for account takeovers, credential stuffing, and fraud. Even with strong password policies and multi-factor authentication, rapid detection is vital. Proactively identifying exposures before they are exploited is a key differentiator in reducing long-term business risk.
https://thehackernews.com/2025/08/leaked-credentials-up-160-what.html
Ransomware Attacks Up by 41% Globally
Global cyber attacks rose sharply in July, with ransomware incidents up 41% year-on-year to 487 cases. North America accounted for over half of these, followed by Europe. Business services, healthcare, and manufacturing were among the most affected sectors, while education faced the highest weekly attack rate at over 4,200 per organisation. North America saw the largest percentage increase. Notable ransomware groups Qilin, Akira, and Play drove much of the activity, with Qilin alone linked to 17% of known cases, reflecting the growing scale and sophistication of financially motivated threats.
https://betanews.com/2025/08/11/ransomware-attacks-up-by-41-percent-globally/
Physical Threats to Crypto Owners Hit Record Highs
Criminals are increasingly targeting cryptocurrency holders through both physical violence and complex online scams. Experts warn that “wrench attacks”, where victims are coerced into handing over their digital assets under threat of harm, have risen sharply, sometimes for amounts as low as $6,000. Leaks of over 80 million user identities, including 2.2 million with home addresses, have made it easier for attackers to locate victims. At the same time, the “GreedyBear” group has stolen more than $1 million through malicious browser extensions, malware, and fake websites, highlighting the growing sophistication and scale of threats in the crypto sector.
https://coinpaper.com/10443/physical-threats-to-crypto-owners-hit-record-highs
The UK Cyber Governance Code of Practice: Beyond Basic Protections to Culture, Leadership and Training
Sectors including financial services, retail and government are facing millions of sophisticated cyber attacks each month. The UK Government’s Cyber Governance Code of Practice urges boards to strengthen cyber risk management by fostering a security-focused culture, improving leadership cyber literacy, and delivering tailored, ongoing training for all staff. In 2024, global ransomware payments reached $813.55 million, underlining the stakes. Technology alone is insufficient; a vigilant, well-trained workforce operating within a Zero Trust framework can significantly enhance defences against today’s fast-evolving digital threats.
https://www.techradar.com/pro/dont-stop-at-basic-protections-make-ongoing-training-a-priority
The Human Firewall: Building a Cyber-Aware Workforce
The UK government’s latest survey shows that half of all businesses, and nearly three quarters of large firms, experienced a cyber security breach in the past year, with the average cost of a UK data breach reaching £3.58 million. As human error is linked to up to 95% of incidents, the focus is shifting from one-off awareness sessions to role-specific training and cultural change. Gamification, real-time feedback, and positive reinforcement are helping organisations turn staff from potential vulnerabilities into proactive defenders, reducing successful attacks, cutting incident response costs, and strengthening compliance.
https://www.telecomstechnews.com/news/the-human-firewall-building-a-cyber-aware-workforce/
Microsoft Warns Organisations Without a Rehearsed Response Plan Are Hit Harder by a Security Incident
Microsoft has warned that organisations without a well-rehearsed incident response plan face longer and more damaging cyber attacks. Only one in four organisations have such a plan and have practised it. Those that regularly test their procedures, run exercises and assess vulnerabilities recover in days rather than months. Experts stressed the need for strong security fundamentals, including keeping software updated, enabling logging and applying proper configurations. Attackers increasingly move quickly, often exploiting basic weaknesses before using advanced techniques, making preparation and early detection critical for limiting business impact. Contact us for details of how Black Arrow can help your leadership team to prepare and rehearse managing the business impact of a cyber security incident.
https://cyberscoop.com/microsoft-threat-intel-response-tips/
Attack Yourself First: the Logic Behind Offensive Security
Recent high-profile cyber attacks on UK retailers have highlighted the speed and sophistication of modern threats, fuelled by automation and AI. Traditional defences such as firewalls and periodic checks are no longer enough, as attackers exploit weaknesses almost instantly. Offensive security, which proactively tests systems through simulated attacks, helps organisations find and fix critical vulnerabilities before criminals can exploit them. Leadership engagement is essential, ensuring cyber security is embedded into business strategy and transformation plans. The strongest organisations will be those that continuously validate their defences rather than relying on assumptions of security.
https://www.techradar.com/pro/attack-yourself-first-the-logic-behind-offensive-security
These Two Ransomware Groups Are Ramping Up Attacks and Have Claimed Hundreds of Victims
Research by Acronis warns that the Akira and Lynx ransomware groups are intensifying attacks on small and medium-sized businesses, particularly managed service providers (MSPs). Akira has claimed over 220 victims and Lynx around 145, often gaining access through stolen credentials, VPN weaknesses, or phishing emails. Both disable security software, steal data, and encrypt systems to extort payment. MSPs are prime targets as they can provide access to multiple customers. Experts advise organisations to strengthen multi-factor authentication, keep external systems patched, and maintain robust, tested backups to reduce the risk of disruption and financial loss.
Financial Services Could Be Next in Line for ShinyHunters
Threat intelligence suggests financially motivated cyber groups are shifting focus towards banks, insurers and financial services, with a 12% rise in targeted domain registrations since July 2025, while targeting of technology firms fell by 5%. Around 700 such domains have been registered this year, some mimicking login portals of major providers. Evidence points to overlap between ShinyHunters and Scattered Spider, both linked to an English-speaking youth movement involved in a range of cyber and physical crimes. Experts advise security leaders to focus on attacker tactics and behaviours rather than group names, to better anticipate and defend against evolving threats.
https://www.infosecurity-magazine.com/news/financial-services-next-line/
Three Notorious Cybercrime Gangs, Scattered Spider, ShinyHunters and Lapsus$, Appear to Be Collaborating
Three well-known cyber crime groups, Scattered Spider, ShinyHunters and Lapsus$, appear to be working together under a loose collective known as The Com. Recent activity suggests Scattered Spider is providing initial access to high-value targets, enabling ShinyHunters to carry out large-scale data theft and extortion. The groups have been linked to coordinated attacks on global retail, insurance, and aviation brands, often exploiting trusted enterprise tools like Salesforce and Okta through social engineering. Experts warn their methods are well-documented but highly effective, with weak helpdesk identity checks and poor multi-factor authentication enforcement remaining key vulnerabilities.
https://www.theregister.com/2025/08/12/scattered_spidershinyhunterslapsus_cybercrime_collab/
Nation State Actor Groups are Getting Personal, Going After Executives in Their Personal Lives
Threat groups linked to nation states are increasingly targeting executives through their personal lives, exploiting less secure home networks, private devices and family connections. Remote working, personal cloud use and active social media profiles provide openings for attackers to gather information and launch phishing or malware campaigns. Experts recommend organisations support executives with secure home network configurations, enterprise-grade device protections, credential monitoring, and training for both the individual and their family. This approach helps reduce the risk of personal-targeted cyber attacks while respecting privacy and avoiding intrusive monitoring.
https://www.helpnetsecurity.com/2025/08/12/apt-executive-cybersecurity-threats/
Governance, Risk and Compliance
Redefining the Role: What Makes a CISO Great
CISOs face a complex tangle of tools, threats, and AI uncertainty - Help Net Security
APT groups are getting personal, and CISOs should be concerned - Help Net Security
The UK’s ‘chronic shortage of cyber professionals’ is putting the country at risk | IT Pro
The human firewall: Building a cyber-aware workforce
Don't stop at basic protections; make ongoing training a priority | TechRadar
How to implement a blameless approach to cybersecurity | Kaspersky official blog
Mastering control of sovereign digital resilience | Computer Weekly
Navigating the Cybersecurity Budget Tug-of-War
What Is the Three Lines Model and What Is Its Purpose? | Definition From TechTarget
Professional services firms stuck in network security IT doom loop | Computer Weekly
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware attacks up by 41 percent globally - BetaNews
ShinyHunters Tactics Now Mirror Scattered Spider
Financial Services Could Be Next in Line for ShinyHunters - Infosecurity Magazine
Cybercrime Groups ShinyHunters, Scattered Spider Join Forces in Extortion Attacks on Businesses
Three notorious cybercrime gangs appear to be collaborating • The Register
Help Desk at Risk: Scattered Spider Shines Light on Overlook Threat Vector - SecurityWeek
Ransomware crews don't care about your EDR • The Register
When Theft Replaces Encryption: Blue Report 2025 on Ransomware & Infostealers
Embargo Ransomware Gang Amasses $34.2m in Attack Proceeds - Infosecurity Magazine
Charon Ransomware Hits Middle East Sectors Using APT-Level Evasion Tactics
New Ransomware Charon Uses Earth Baxia APT Techniques to Target Enterprises | Trend Micro (US)
Crypto24 ransomware hits large orgs with custom EDR evasion tool
Akira Ransomware Exploits SonicWall Zero-Day with BYOVD Evasion
MedusaLocker ransomware group is looking for pentesters
Embargo Ransomware nets $34.2M in crypto since April 2024
MuddyWater’s DarkBit ransomware cracked for free data recovery
Ransomware crew dumps 43GB Saint Paul files, no ransom paid • The Register
North Korea Attacks South Koreans With Ransomware
Intel gathered following HSE attack leads to dismantling of ransomware gang – The Irish Times
US govt seizes $1 million in crypto from BlackSuit ransomware gang
Researchers cracked the encryption used by DarkBit ransomware
UK firms turn to back-ups over ransom payments - CIR Magazine
Law Enforcement Disrupts BlackSuit Ransomware Gang
Ransomware Victims
Google suffers a serious data breach at the hands of a ransomware group - PhoneArena
Google Confirms Data Breach - Notifying Users Affected By the Cyberattack
M&S still struggling with IT issues following cyberattack - Retail Gazette
Australian Regulator Sues Optus Over 2022 Data Breach - Infosecurity Magazine
What happened when cybercriminals hit a recruitment firm
M&S click and collect finally returns months after cyberattack | The Independent
Boeing, US Navy supplier Jamco Aerospace claimed in ransomware attack | Cybernews
Manpower franchise discloses data breach • The Register
Phishing & Email Based Attacks
The Rise of Native Phishing: Microsoft 365 Apps Abused in Attacks
Threat Actors Personalize Phishing Attacks With Advanced Tactics for Malware Delivery
Phishing attacks exploit WinRAR flaw CVE-2025-8088 to install RomCom
WinRAR zero-day exploited to plant malware on archive extraction
Booking.com phishing campaign uses sneaky 'ん' character to trick you
Hackers Using Dedicated Phishlet to Launch FIDO Authentication Downgrade Attacks
For $40, you can buy stolen police and government email accounts - Help Net Security
Other Social Engineering
Help Desk at Risk: Scattered Spider Shines Light on Overlook Threat Vector - SecurityWeek
Google confirms data breach exposed potential Google Ads customers' info
Fraud, Scams and Financial Crime
FTC: older adults lost record $700 million to scammers in 2024
WhatsApp Bans 6.8M Scam Accounts in Southeast Asia with AI Tools
Deepfake detectors are coming of age, at a time of dire need • The Register
'Chairmen' of $100 million scam operation extradited to US
Over $300 million in cybercrime crypto seized in anti-fraud effort
Artificial Intelligence
MITRE: Russian APT28's LameHug, a Pilot for Future AI Cyber-Attacks - Infosecurity Magazine
CISOs face a complex tangle of tools, threats, and AI uncertainty - Help Net Security
Red Teams Jailbreak GPT-5 With Ease, Warn It's ‘Nearly Unusable’ for Enterprise - SecurityWeek
Prompt injection vuln found in Google Gemini apps • The Register
Don't fall for AI-powered disinformation attacks online - here's how to stay sharp | ZDNET
Black Hat 2025: ChatGPT, Copilot, DeepSeek now create malware | VentureBeat
Guess what else GPT-5 is bad at? Security | CyberScoop
Leading AI Agents Like ChatGPT Are Vulnerable to Hacking, Security Firm Finds
New Report Warns of Looming Security Crisis as AI Agents Proliferate
62% of People Believe AI Agents Are Easier To Deceive Than Humans - IT Security Guru
Deepfake detectors are coming of age, at a time of dire need • The Register
Research reveals possible privacy gaps in Apple Intelligence’s data handling | CyberScoop
Echo Chamber, Prompts Used to Jailbreak GPT-5 in 24 Hours
From Lab to Deployment: AI-Powered Agents in Action
Google Cloud Warns of AI-Driven Ransomware Threats and Key Defenses
Employees race to build custom AI apps despite security risks - Help Net Security
Chinese biz using AI to influence US politicians • The Register
2FA/MFA
Hackers Using Dedicated Phishlet to Launch FIDO Authentication Downgrade Attacks
FIDO authentication undermined | CSO Online
Malware
Threat Actors Personalize Phishing Attacks With Advanced Tactics for Malware Delivery
When Theft Replaces Encryption: Blue Report 2025 on Ransomware & Infostealers
Phishing attacks exploit WinRAR flaw CVE-2025-8088 to install RomCom
WinRAR zero-day exploited to plant malware on archive extraction
BadCam: Linux-based Lenovo webcam bugs enable BadUSB attacks
Adult sites are stashing exploit code inside racy .svg files - Ars Technica
Russia's RomCom among those exploiting a WinRAR 0-day • The Register
This new malware really goes the extra mile when it comes to infecting your devices | TechRadar
Hackers Found Using CrossC2 to Expand Cobalt Strike Beacon's Reach to Linux and macOS
Malvertising Campaign Deploys Modular PowerShell Malware PS1Bot - Infosecurity Magazine
Popular Apps Are Vessels for Malware—Here’s How To Protect Yourself
Mobile
Hackers Could Gain Full Control of Your Rooted Android Devices by Exploiting One Vulnerability
4 ways I spot and avoid phishing scams on my iPhone
KernelSU v0.5.7 Flaw Lets Android Apps Gain Root Access - Infosecurity Magazine
Denial of Service/DoS/DDoS
How to prevent DoS attacks and what to do if they happen | TechTarget
New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP
Critical internet flaw lets attackers crash servers | Cybernews
'MadeYouReset' HTTP2 Vulnerability Enables Massive DDoS Attacks - SecurityWeek
Internet of Things – IoT
BadCam: Linux-based Lenovo webcam bugs enable BadUSB attacks
Hackers Can Take Over Your Security Cameras—and It’s Easier Than You Think
Hyundai UK charging customers for luxury of secure car locks • The Register
Hackers Went Looking for a Backdoor in High-Security Safes—and Now Can Open Them in Seconds | WIRED
Hackers love these 7 smart home devices — here’s how to keep them secure | Tom's Guide
Smart Buses flaws expose vehicles to tracking, control, and spying
Data Breaches/Leaks
Leaked Credentials Up 160%: What Attackers Are Doing With Them
Google suffers a serious data breach at the hands of a ransomware group - PhoneArena
The US Court Records System Has Been Hacked | WIRED
New Active Directory Lateral Movement Techniques that Bypasses Authentication and Exfiltrate Data
Australian Regulator Sues Optus Over 2022 Data Breach - Infosecurity Magazine
The inside story of the Telemessage saga • The Register
North Korean Kimsuky hackers exposed in alleged data breach
Hackers leak 2.8M sensitive records from Allianz Life in Salesforce data breach
Cancer care provider breach exposes 113K+ patients | Cybernews
Connex Credit Union data breach impacts 172,000 members
Italian hotels breached en masse since June, gov confirms • The Register
ICE Accidentally Adds Wrong Person to Sensitive Group Chat About Manhunt
Organised Crime & Criminal Actors
Three notorious cybercrime gangs appear to be collaborating • The Register
Researchers identify Chinese cybercriminal working for North Korean threat group | NK News
6 ways hackers hide their tracks | CSO Online
Dark web websites: 10 things you should know | CSO Online
Cybercriminals Exploit Low-Cost Initial Access Broker Market - Infosecurity Magazine
Threat actors move to smaller more persistent attacks - BetaNews
How money mules powered cyber cons’ ‘operating system’ | Lucknow News - Times of India
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Attackers Target the Foundations of Crypto: Smart Contracts
Physical Threats to Crypto Owners Hit Record Highs
The rise of real-world cyber threats | Opinion
Over $300 million in cybercrime crypto seized in anti-fraud effort
Embargo Ransomware nets $34.2M in crypto since April 2024
Insurance
Cyber insurance market shows early signs of maturity - Help Net Security
How Insurers Use Threat Intelligence to Reduce Losses
Cloud/SaaS
Google Cloud Warns of AI-Driven Ransomware Threats and Key Defenses
Outages
Major outage at Pennsylvania OAG blamed on 'cyber incident' • The Register
Identity and Access Management
New Active Directory Lateral Movement Techniques that Bypasses Authentication and Exfiltrate Data
Encryption
BitUnlocker - Multiple 0-days to Bypass BitLocker and Extract All Protected Data
New TETRA Radio Encryption Flaws Expose Law Enforcement Communications
White House could stymie the UK’s anti-encryption plans? • The Register
Linux and Open Source
BadCam: Linux-based Lenovo webcam bugs enable BadUSB attacks
Passwords, Credential Stuffing & Brute Force Attacks
46% of Enterprise Passwords Can Be Cracked | Security Magazine
Leaked Credentials Up 160%: What Attackers Are Doing With Them
Nearly half of enterprises tested had passwords cracked in Picus Security report - SiliconANGLE
Malvertising
Malvertising Campaign Deploys Modular PowerShell Malware PS1Bot - Infosecurity Magazine
Training, Education and Awareness
The human firewall: Building a cyber-aware workforce
Don't stop at basic protections; make ongoing training a priority | TechRadar
Regulations, Fines and Legislation
UK proxy traffic surges as users consider VPN alternatives • The Register
FCC tightens rules on foreign firms building undersea cables, citing security | CyberScoop
Government expands police use of live facial recognition vans - BBC News
Porn site traffic plummets as UK age verification rules enforced - BBC News
Australian Regulator Sues Optus Over 2022 Data Breach - Infosecurity Magazine
UK passport database images used in facial recognition scans • The Register
Home Office explores biometric enrolment via smartphone – PublicTechnology
Eight Countries Face EU Action Over NIS2 Deadline Failings - Infosecurity Magazine
White House could stymie the UK’s anti-encryption plans? • The Register
Campaigners Slam Expansion of Police Facial Recognition Schemes in UK - Infosecurity Magazine
The overlooked changes that two Trump executive orders could bring to cybersecurity | CyberScoop
EU law to protect journalists from spyware takes effect | The Record from Recorded Future News
Trump's unusual Nvidia deal raises new corporate and national security risks - The Economic Times
Models, Frameworks and Standards
EU Targets Nations Lagging on NIS2 Cyber Rules | SC Media UK
Eight Countries Face EU Action Over NIS2 Deadline Failings - Infosecurity Magazine
Careers, Working in Cyber and Information Security
The UK’s ‘chronic shortage of cyber professionals’ is putting the country at risk | IT Pro
Top Cybersecurity Certifications Drive $150K+ Salaries Amid US Shortage
How military leadership prepares veterans for cybersecurity success - Help Net Security
Law Enforcement Action and Take Downs
Dark web websites: 10 things you should know | CSO Online
Over $300 million in cybercrime crypto seized in anti-fraud effort
'Chairmen' of $100 million scam operation extradited to US
US govt seizes $1 million in crypto from BlackSuit ransomware gang
Law Enforcement Disrupts BlackSuit Ransomware Gang
Intel gathered following HSE attack leads to dismantling of ransomware gang – The Irish Times
Misinformation, Disinformation and Propaganda
Don't fall for AI-powered disinformation attacks online - here's how to stay sharp | ZDNET
Your Internet, their rules: How DNS blocking shapes what we see online
Chinese biz using AI to influence US politicians • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Commander of Polish Cyberspace Defense Forces: we are in our conflict phase
China Is Winning the Cyberwar | Foreign Affairs
Nation State Actors
APT groups are getting personal, and CISOs should be concerned - Help Net Security
China
China Is Winning the Cyberwar | Foreign Affairs
APT groups are getting personal, and CISOs should be concerned - Help Net Security
Silicon under siege: Nation-state hackers target semiconductor supply chains | CSO Online
Trump's unusual Nvidia deal raises new corporate and national security risks - The Economic Times
Researchers identify Chinese cybercriminal working for North Korean threat group | NK News
Chinese biz using AI to influence US politicians • The Register
Russia
MITRE: Russian APT28's LameHug, a Pilot for Future AI Cyber-Attacks - Infosecurity Magazine
Commander of Polish Cyberspace Defense Forces: we are in our conflict phase
Russia's RomCom among those exploiting a WinRAR 0-day • The Register
Finland charges tanker crew members with sabotage of undersea cables | Finland | The Guardian
REvil Actor Accuses Russia of Planning 2021 Kaseya Attack
Russia said to be behind US Federal Court systems hack | Cybernews
Norway spy chief blames Russian hackers for dam sabotage in April | Reuters
North Korea
North Korean Kimsuky hackers exposed in alleged data breach
Hackers breach and expose a major North Korean spying operation | TechCrunch
Researchers identify Chinese cybercriminal working for North Korean threat group | NK News
North Korean network breached, hackers claim - Washington Times
North Korea Attacks South Koreans With Ransomware
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
EU law to protect journalists from spyware takes effect | The Record from Recorded Future News
Tools and Controls
CISOs face a complex tangle of tools, threats, and AI uncertainty - Help Net Security
The human firewall: Building a cyber-aware workforce
Don't stop at basic protections; make ongoing training a priority | TechRadar
Ransomware crews don't care about your EDR • The Register
Pentesting is now central to CISO strategy - Help Net Security
UK proxy traffic surges as users consider VPN alternatives • The Register
Cyber insurance market shows early signs of maturity - Help Net Security
Crypto24 ransomware hits large orgs with custom EDR evasion tool
Navigating the Cybersecurity Budget Tug-of-War
Black Hat/DEF CON: AI more useful for defense than hacking • The Register
Why DNS threats should be on every CISO's radar in 2025 - Help Net Security
Attack yourself first: the logic behind offensive security | TechRadar
How Insurers Use Threat Intelligence to Reduce Losses
FIDO authentication undermined | CSO Online
Deepfake detectors are coming of age, at a time of dire need • The Register
WhatsApp Bans 6.8M Scam Accounts in Southeast Asia with AI Tools
What Is the Three Lines Model and What Is Its Purpose? | Definition From TechTarget
UK Red Teamers “Deeply Skeptical” of AI - Infosecurity Magazine
Your Internet, their rules: How DNS blocking shapes what we see online
Porn site traffic plummets as UK age verification rules enforced - BBC News
UK traffic to popular porn sites slumps after age checks introduced | Internet safety | The Guardian
Professional services firms stuck in network security IT doom loop | Computer Weekly
The rising need for offensive security strategy and skill | SC Media
Reports Published in the Last Week
When Theft Replaces Encryption: Blue Report 2025 on Ransomware & Infostealers
Other News
6 ways hackers hide their tracks | CSO Online
Threat actors move to smaller more persistent attacks - BetaNews
Mastering control of sovereign digital resilience | Computer Weekly
What happens when cyber attacks break more than just networks? | Insurance Business America
Everything You Should Know About Wi-Fi Jammers and Your Home Security - CNET
Ex-NSA Chief Paul Nakasone Has a Warning for the Tech World | WIRED
South Korea’s Yes24 ticketing platform hit by cyber attack - TheTicketingBusiness News
Vulnerability Management
Microsoft Sued For Killing Windows 10—All Users Must Act Now
Windows 11 23H2 Home and Pro reach end of support in November
Vulnerabilities
Russia's RomCom among those exploiting a WinRAR 0-day • The Register
Over 29,000 Exchange servers unpatched against high-severity flaw
Microsoft August 2025 Patch Tuesday Fixes Kerberos Zero-Day Among 111 Total New Flaws
Over 3,000 NetScaler devices left unpatched against CitrixBleed 2 bug
Zoom patches critical Windows flaw allowing privilege escalation
Active attacks target Office vuln patched 8 years ago • The Register
Spike in Fortinet VPN brute-force attacks raises zero-day concerns
Cisco Warns of CVSS 10.0 FMC RADIUS Flaw Allowing Remote Code Execution
FortiWeb Authentication Bypass Vulnerability Let Attackers Log in As Any Existing User
Windows Remote Desktop Services Vulnerability Let Attacker Deny Services Over Network
BitUnlocker - Multiple 0-days to Bypass BitLocker and Extract All Protected Data
New Active Directory Lateral Movement Techniques that Bypasses Authentication and Exfiltrate Data
New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP
'MadeYouReset' HTTP2 Vulnerability Enables Massive DDoS Attacks - SecurityWeek
Red Teams Jailbreak GPT-5 With Ease, Warn It's ‘Nearly Unusable’ for Enterprise - SecurityWeek
Prompt injection vuln found in Google Gemini apps • The Register
Akira Ransomware Exploits SonicWall Zero-Day with BYOVD Evasion
Windows Hello for Business Flaw Could Allow Unauthorized Access
WinRAR Zero-Day Under Active Exploitation – Update to Latest Version Immediately
Microsoft Entra OAuth Flaw Exposed Internal Apps to Unauthorized Access
SonicWall pins firewall attack spree on year-old vulnerability | CyberScoop
Netherlands: Citrix Netscaler flaw CVE-2025-6543 exploited to breach orgs
Fortinet, Ivanti Release August 2025 Security Patches - SecurityWeek
Critical FortiSIEM Vulnerability Let Attackers to Execute Malicious Commands - PoC Found in Wild
Fortinet SSL VPNs Hit by Global Brute-Force Wave Before Attackers Shift to FortiManager
New Linux Kernel Vulnerability Directly Exploited from Chrome Renderer Sandbox
7-Zip Arbitrary File Write Vulnerability Let Attackers Execute Arbitrary Code
Trend Micro reports two critical CVEs under active exploit • The Register
Chipmaker Patch Tuesday: Many Vulnerabilities Addressed by Intel, AMD, Nvidia - SecurityWeek
Vulnerabilities in Xerox Print Orchestration Product Allow Remote Code Execution - SecurityWeek
Hackers Could Gain Full Control of Your Rooted Android Devices by Exploiting One Vulnerability
SAP fixed 26 flaws in August 2025 Update, including 4 Critical
Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks
Flaws in a pair of Grafana plugins could hand over DevOps control | CSO Online
New TETRA Radio Encryption Flaws Expose Law Enforcement Communications
KernelSU v0.5.7 Flaw Lets Android Apps Gain Root Access - Infosecurity Magazine
Matrix admits 'high severity' flaws need breaking fixes • The Register
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.