HOT NEWS 2025ALL

A new ransomware variant named Jackpot, linked to the MedusaLocker family, has emerged leveraging a double extortion strategy that combines file encryption with the theft of sensitive data.

According to a recent report from SentinelLabs, China-backed threat actors have deployed ShadowPad and PurpleHaze malware in global campaigns.

A recent activity attributed to the VenomRAT malware has been spotted in the wild. Malware is spread from a phishing website disguised as AV software download page.

KeePass is a popular open source password manager application. Recently there have been reports about an ongoing campaign distributing fake KeePass installers targeted at ESXi environments.

Mamona Ransomware is a newly discovered threat in the commodity ransomware landscape that operates entirely offline, with no external communication or data exfiltration. The malware uses custom encryption routines to encrypt user files, renaming them with the .HAes extension.

DATE	NAME	INFO	CATEGORY	SUBCATE
31.12.25	DarkSpectre	DarkSpectre: Unmasking the Threat Actor Behind 8.8 Million Infected Browsers	HACKING	BROWSER
31.12.25	CVE-2025-13915	IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.	VULNEREBILITY	VULNEREBILITY
31.12.25	Shai Hulud	Shai Hulud strikes again - The golden path	MALWARE	PYTHON
31.12.25	CVE-2025-52691	Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.	VULNEREBILITY	VULNEREBILITY
31.12.25	Silver Fox	Silver Fox Targeting India Using Tax Themed Phishing Lures	APT	APT
31.12.25	HoneyMyte	The HoneyMyte APT evolves with a kernel-mode rootkit and a ToneShell backdoor	APT	APT
27.12.25	Panda APT	The Evasive Panda APT group (also known as Bronze Highland, Daggerfly, and StormBamboo) has been active since 2012, targeting multiple industries with sophisticated, evolving tactics. Our latest research (June 2025) reveals that the attackers conducted highly-targeted campaigns, which started in November 2022 and ran until November 2024.	APT	APT
27.12.25	CVE-2025-14847	Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2	VULNEREBILITY	VULNEREBILITY
27.12.25	UNG0801	Key Targets. Industries Affected. Geographical Focus. Infection Chain – Operation IconCat. Infection Chain – I. Infection Chain – II. Campaign-Analysis – Operation IconCat. Campaign-I Initial Findings. Looking into the malicious PDF File. Technical Analysis. Malicious PyInstaller implant – PYTRIC...	GROUP	GROUP
25.12.25	Pytric and Rustric implants leveraged in UNG0801 malicious operations	A new malicious activity attributed to a persistent threat cluster designated as UNG0801 (aka Operation IconCat) has been reported in the wild. The campaign targets specifically Israeli enterprise environments. The attackers employ sophisticated social engineering techniques, utilizing Hebrew-language phishing lures that mimic internal corporate communications.	ALERTS	GROUP
25.12.25	MacSync Stealer malware	Jamf Threat Labs has identified an updated variant of the MacSync Stealer malware, that leverages code-signed binaries able to deliver the malicious payloads without user interaction. To evade detection, the attackers also inflate the malicious application bundle to over 25 MBs using decoy PDFs and employ a Swift-based helper to execute the malicious scripts.	ALERTS	VIRUS
25.12.25	CVE-2025-34392 - Barracuda Service Center absolute path traversal vulnerability	CVE-2025-34392 is a recently disclosed critical (CVSS score 10.0) absolute path traversal vulnerability affecting Barracuda Service Center, which is a web-based management console for Barracuda Managed Workplace (RMM). If successfully exploited the flaw might allow unauthorized attackers to perform arbitrary file write operations and remote code execution via malicious webshell upload.	ALERTS	VULNEREBILITY
25.12.25	Paper Werewolf campaign delivering EchoGather malware	Researchers from Intezer reported on a new malicious activity attributed to the Paper Werewolf threat group (aka GOFFEE). The attackers leverage XLL-based delivery techniques to distribute a custom backdoor dubbed EchoGather.	ALERTS	CAMPAIGN
25.12.25	Caminho and DCRAT malware variants leveraged by the Blind Eagle APT	Zscaler researchers identified a recent spear-phishing campaign attributed to the BlindEagle threat group that has been targeting Colombian institutions. The operation utilized phishing emails, a fake web portal, PowerShell scripts, steganography to hide payloads, and legitimate services like Discord to host arbitrary payloads.	ALERTS	VIRUS
25.12.25	AshTag malware distributed by the Ashen Lepus APT	Researchers from Palo Alto have detailed an evolving espionage campaign attributed to the Ashen Lepus APT group. This campaign has introduced a fully featured, modular .NET malware dubbed AshTag. The infection chain relies on social engineering and DLL side-loading performed by the AshenLoader malware.	ALERTS	APT
25.12.25	PyStoreRAT malware	A new sophisticated supply chain attack utilizing dormant GitHub accounts to distribute a previously undocumented malware dubbed PyStoreRAT has been reported in the wild.	ALERTS	VIRUS
25.12.25	RansomHouse RaaS	RansomHouse is a Ransomware-as-a-Service (RaaS) operation attributed to the threat actor Jolly Scorpius. This group employs a double-extortion method, generating revenue through ransoming encrypted files and sensitive data, and primarily targets virtualized environments through their MrAgent and Mario components.	ALERTS	RANSOM
25.12.25	SantaStealer - a new MaaS infostealer	Rapid7 Labs has identified a new infostealer variant dubbed SantaStealer, which is currently advertised on underground forums and offered for sale under the Malware-as-a-Service (MaaS) offering. Functionally, SantaStealer is designed to harvest sensitive data from browsers, including credentials, cookies, and credit card details.	ALERTS	VIRUS
25.12.25	Frogblight mobile malware	Frogblight is a sophisticated Android banking malware operating under the Malware-as-a-Service model and targeting specifically Turkish users through a combination of banking theft and spyware capabilities. As reported by the researchers from Securelist, the malware spreads via social engineering, utilizing phishing SMS messages that falsely warn victims of pending court cases.	ALERTS	VIRUS
25.12.25	CVE-2025-6389 - WordPress Sneeit Framework plugin vulnerability under active exploitation	CVE-2025-6389 is a recently disclosed critical (CVSS score 9.8) Remote Code Execution (RCE) vulnerability affecting Sneeit Framework plugin for WordPress.	ALERTS	VULNEREBILITY
25.12.25	Longlegs group attributed to multiple campaigns delivering ransomware	The Longlegs (aka Gold Salem, Storm-2603) threat actor group has established itself in early 2025 through the distribution of Warlock ransomware. The group gained notoriety in mid-2025 following exploitation of ToolShell, a collection of Microsoft SharePoint vulnerabilities.	ALERTS	GROUP
25.12.25	CVE-2025-58360 - OSGeo GeoServer XML External Entity (XXE) vulnerability	CVE-2025-58360 is a recently disclosed critical (CVSS score 9.8) XML External Entity (XXE) vulnerability affecting GeoServer, which is an open-source software server written in Java that allows for editing and sharing of geospatial data. If successfully exploited the flaw might allow an unauthenticated attacker to access arbitrary files from the server's file system or to conduct Server-Side Request Forgery (SSRF) attacks	ALERTS	VULNEREBILITY
25.12.25	CVE-2020-12812	An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.	VULNEREBILITY	VULNEREBILITY
25.12.25	CVE-2023-52163	Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.	VULNEREBILITY	VULNEREBILITY
25.12.25	AuraStealer	Defeating AuraStealer: Practical Deobfuscation Workflows for Modern Infostealers	MALWARE	STEALER
25.12.25	GhostPairing Attacks	GhostPairing Attacks: from phone number to full access in WhatsApp	ATTACK	ATTACK
25.12.25	CVE-2023-21554	Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	VULNEREBILITY	VULNEREBILITY
25.12.25	CVE-2025-43300	An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12.	VULNEREBILITY	VULNEREBILITY
25.12.25	SantaStealer	SantaStealer is Coming to Town: A New, Ambitious Infostealer Advertised on Underground Forums	MALWARE	INFOSTEALER
25.12.25	MacSync	From ClickFix to code signed: the quiet shift of MacSync Stealer malware	MALWARE	Mac OS
24.12.25	Prince of Persia	Prince of Persia: A Decade of Iranian Nation-State APT Campaign Activity under the Microscope	APT	APT
24.12.25	Wonderland	Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan	MALWARE	ANDROID
24.12.25	NexusRoute	NexusRoute: Attempting to Disrupt an Indian Government Ministry	MALWARE	ANDROID
24.12.25	Frogblight	Frogblight threatens you with a court case: a new Android banker targets Turkish users	MALWARE	ANDROID BANKING
24.12.25	Cellik	Meet Cellik - A New Android RAT With Play Store Integration	MALWARE	ANDROID RAT
24.12.25	CVE-2025-68613	n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system.	VULNEREBILITY	VULNEREBILITY
20.12.25	Vulnerability in UEFI firmware modules prevents IOMMU initialization on some UEFI-based motherboards	A newly identified vulnerability in some UEFI-supported motherboard models leaves systems vulnerable to early-boot DMA attacks across architectures that implement UEFI and IOMMU.	ALERT	ALERT
20.12.25	Siemens Gridscale X Prepay username enumeration and account lock bypass vulnerability	Vulnerabilities have been identified in Siemens Gridscale X Prepay that allows unauthenticated username enumeration and enables an attacker to bypass account lock functionality.	ALERT	ALERT
20.12.25	ESET Threat Report H2 2025	A view of the H2 2025 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts	REPORT	REPORT