Will Burns

IT Engineer

Hacker Leaks Data of 3 Million NYU Applicants in Website Breach

New York University suffered a major data breach when a hacker hijacked an NYU website on Saturday, exposing admissions records of over 3 million applicants spanning decades​. For at least two hours, visitors to an NYU subdomain were presented with lists of names, SAT/ACT scores, GPAs, intended majors, zip codes, and even financial aid and family information dating back to 1989​. The hacker claimed the motive was to “expose” alleged illegal admissions practices, but in doing so leaked massive amounts of sensitive personal data​. NYU’s IT team quickly took down the malicious page and is investigating the incident with law enforcement​. The attacker bragged that the breach was accomplished by exploiting unpatched web software rather than any sophisticated zero-day​. NYU has begun notifying affected individuals and shoring up its systems, as the exposed student records may have implications under education privacy laws​. 

New “VanHelsing” Ransomware-as-a-Service Emerges

Security researchers are warning of a new multi-platform ransomware-as-a-service (RaaS) operation dubbed “VanHelsing.” Launched in early March, VanHelsing’s malware can target Windows, Linux (including VMware ESXi), BSD, and ARM-based systems​. The RaaS was advertised on cybercrime forums with a unique model: experienced affiliates can join free, while newcomers must pay a $5,000 deposit​. According to Check Point, the group appears to be a Russian cybercrime project and explicitly forbids attacking entities in CIS (former Soviet) countries​. Affiliates keep 80% of any ransom paid, with 20% going to the operators. In its first two weeks, VanHelsing’s leak site already listed three victims — two in the U.S. and one in France — including a city government in Texas and two tech companies​. The gang is threatening to publish stolen data if ransoms (around $500,000 per victim) aren’t paid​. The malware itself is written in C++ and employs ChaCha20 encryption with Curve25519 public-key protection, using a stealthy two-phase encryption process to avoid detection​. Analysts note that VanHelsing’s code and tactics suggest it’s still evolving, but its rapid debut and multi-OS capability make it a significant new threat on the ransomware scene.

Cyberattack Disrupts Ukraine’s Railway Ticketing System

Ukraine’s national railway operator (Ukrzaliznytsia) was hit by a massive cyberattack that crippled its online ticketing services on March 23​. Travelers were unable to purchase tickets via the website or mobile apps, forcing crowds to line up at station counters and causing significant delays and frustration​. The railway, a crucial transport mode especially during the ongoing conflict, had to activate backup manual processes. In a public update, Ukrzaliznytsia said the attackers’ “key objective failed” – train operations continued on schedule using offline alternatives – and that prior experience with cyberattacks had strengthened its resilience and incident response​. The company described the attack as “highly systematic and multi-layered,”and its cyber teams are working with Ukraine’s SBU security service and CERT-UA to investigate and restore normal services​. Thus far, no specific hacker group has been publicly blamed, but officials implied the “enemy” (a likely reference to Russian actors amid the war) was behind the intrusion​. The incident highlights ongoing efforts to disrupt Ukraine’s critical infrastructure, even as the railway vowed that “even the most devious cyberattacks cannot stop” its operations​.

Attackers Abuse Microsoft Code-Signing Platform to Evade Detection

Threat actors are exploiting Microsoft’s new Trusted Signing service to obtain authentic code signatures for their malware​. This cloud-based service, launched in 2024 to help developers easily sign software, issues short-lived three-day digital certificates for executables. However, researchers found cybercriminals using it to sign malicious files, which then remain trusted even after the cert’s 3-day validity, until Microsoft explicitly revokes it​. Multiple malware samples (including info-stealers like “Lumma” and others) were found signed by Microsoft’s “ID Verified” certificate authority​. Microsoft acknowledged the abuse and said it is actively monitoring for such misuse​. The company’s security teams are revoking rogue certificates and suspending involved accounts once identified​. In this case, Microsoft has already revoked the certificates tied to the discovered malware and confirmed its Defender anti-malware products detect those samples. The incident illustrates how attackers continuously seek trust mechanisms to bypass security – in this case turning a legitimate code-signing service against itself – and it puts pressure on providers to quickly clamp down on abuse. Microsoft has tightened verification requirements for corporate signing and relies on threat intel to catch illicit use​, but the cat-and-mouse game between certificate misuse and revocation is ongoing.

Critical Next.js Web Framework Vulnerability Disclosed

A critical vulnerability (CVE-2025-29927) in the popular Next.js web development framework was revealed, prompting urgent updates from developers. The flaw (CVSS 9.1) could allow attackers to bypass middleware authorization checks in Next.js applications under certain conditions​. Next.js uses a special internal HTTP header (x-middleware-subrequest) to prevent infinite loops in request processing. Researchers discovered that a crafted request could abuse this header to skip executing middleware entirely – meaning security logic like authentication or authorization could be bypassed, letting an unauthorized request reach a protected API route or page​. In practical terms, an attacker might access sensitive functions or data that should be gated by login checks. Vercel (the maintainer of Next.js) released patched versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3 to fix the issue​. They advised all Next.js users to upgrade immediately; if immediate patching isn’t possible, a suggested mitigation is to block any external requests containing the x-middleware-subrequest header from reaching the app​. This incident serves as a reminder to keep web frameworks up to date, as their vulnerabilities can have far-reaching impact on numerous sites and applications.

Security Initiatives: Cloudflare Enforces HTTPS Only; Microsoft Edge Guards GenAI Data

Industry players rolled out new security measures over the past few days to counter emerging threats. Cloudflare announced that it will now block all unencrypted HTTP traffic to its API endpoints, requiring HTTPS for any API requests​. Previously, a script or user hitting the Cloudflare API over HTTP might get a redirect or error, but as of March 22, such connections are simply rejected to eliminate any chance of sensitive data leaking in transit. This proactive step helps ensure that API keys and commands to Cloudflare’s services (used for managing DNS, firewall, DDoS settings, etc.) are never exposed in plaintext, even due to user misconfiguration.

Meanwhile, Microsoft introduced a new data-protection feature in its Edge for Business browser aimed at the rise of generative AI in the workplace. The feature, announced March 24, provides “inline data protection” to prevent employees from unintentionally sharing sensitive corporate information with AI chatbots and other external web apps. In practice, Edge for Business can now detect when a user is about to input potentially confidential data into a site like ChatGPT, Google’s Gemini, or other GenAI and cloud apps, and then block or redact the data before it leaves the browser​. This is an extension of Microsoft Purview’s data loss prevention (DLP) capabilities into the browser, coming as part of broader efforts (including new security features in Teams) to mitigate insider risks and phishing via collaboration tools. Both Cloudflare’s and Microsoft’s moves show how organizations are bolstering defenses: Cloudflare by hardening infrastructure defaults, and Microsoft by adapting to new AI-related data leakage concerns in enterprise settings. Each initiative is a response to real-world threat trends observed in recent months.

https://www.bleepingcomputer.com/news/security/cloudflare-now-blocks-all-unencrypted-traffic-to-its-api-endpoints/

Stay updated on the latest cybersecurity threats, including a massive NYU data breach, the emergence of VanHelsing ransomware, a cyberattack on Ukraine’s railway, a critical Next.js vulnerability, and new security measures from Microsoft and Cloudflare.

Cybersecurity Roundup: Major Breaches, Emerging Ransomware, and Critical Vulnerabilities

Chinese APT ‘FamousSparrow’ Resurfaces: 

Researchers from ESET uncovered new activity by the Chinese state-linked hacking group FamousSparrow, which had been dormant since 2022. The group has been targeting organizations in the U.S., Mexico, and Honduras, deploying upgraded variants of its custom backdoor SparrowDoor. Code overlaps confirm the link to previous FamousSparrow campaigns, which were known for targeting hotels and even government agencies. Recent victims include a U.S. trade association, a Honduran government entity, and a Mexican research institute, indicating the group’s cyber-espionage operations are active once again.

Chrome Zero Day Used in Russian Espionage Campaign:

 Google released an emergency Chrome update after Kaspersky researchers discovered a zero-day vulnerability (CVE-2025 2783) being exploited in the wild. The high-severity flaw, an “incorrect handle” issue in Chrome’s Mojo, allowed attackers to escape the browser sandbox and deliver malware. The exploit was used in a cyber-espionage campaign dubbed “Operation ForumTroll,” which targeted Russian media and educational organizations via phishing emails posing as invitations to a conference. Google has patched the bug in Chrome 134.0.6998.178 for Windows, and most users are advised to update immediately, as attackers chained this sandbox escape with a second exploit to fully compromise targets.

New ‘Arkana’ Ransomware Hits U.S. Telecom:

 A newly emerged ransomware gang calling itself Arkana Security claims to have breached WideOpenWest (WOW!), a U.S. cable and broadband provider. The group listed WOW! on its leak site as its first victim, alleging it gained deep access to internal systems (like AppianCloud and Symphonica) and stole two databases holding ~2.6 million combined customer accounts. Arkana has threatened to leak or sell the stolen data – which purportedly includes usernames, passwords, emails, and more – and even to deploy malware to customer devices if a “fee” (ransom) is not paid. The gang also doxxed company executives on its site. WOW! has not confirmed the hack and is working to validate the claims while facing potential reputational and legal fallout.

Ransom Demand Disrupts Malaysian Airport:

 Over the weekend, Malaysia’s busiest airport, KLIA, suffered computer outages that authorities now attribute to a cyberattack on the airport operator. Officials confirmed the attack began March 23 and involved perpetrators demanding a $10 million ransom from Malaysia Airports Holdings Berhad. Malaysia’s Prime Minister Anwar Ibrahim stated he immediately refused to pay, asserting the country would not bow to “ultimatums by criminals”. While no specific ransomware group has claimed responsibility and officials have not confirmed if ransomware was used, the incident caused over 10 hours of disruptions – flight info displays went down and staff resorted to manual whiteboard communication. Airport operations continued with backups, and authorities are investigating as the government faces criticism for initial opaque communications about the “network failure.”

Cyberattack on South African Food Producer:

 South Africa’s largest poultry supplier, Astral Foods, revealed that a March 16 cyberattack cost it roughly 20 million rand (~$1 million) in lost profits due to a week-long operational disruption. The attack forced Astral to enact full disaster recovery procedures, causing downtime in chicken processing and delivery backlogs. By March 25 the company had recovered systems and reported that all business units were operating normally. Astral stated no sensitive customer or supplier data was compromised in the “cyber intrusion”. While the company did not disclose the attack type or culprit, no known ransomware gang has claimed credit as of this week. The incident underscores the risk to agricultural supply chains – over 167 ransomware attacks hit the food/agriculture sector in 2023, and even brief IT outages can significantly impact production and earnings.

Ransomware Gang Exploits Windows Zero Day: 

Security researchers revealed that a Russian ransomware outfit (tracked as EncryptHub/RansomHub) was exploiting a previously unknown Windows vulnerability before Microsoft’s patch. The flaw (CVE-2025-26633) in the Windows Management Console (MMC), patched in early March, was used to execute code and steal data from targets as part of an extortion campaign. The attackers crafted malicious Microsoft Console (.msc) files and tricked the system into loading them via a path hijacking trick in the MMC’s multi-lingual interface, allowing them to run commands without detection. Trend Micro investigators warn that this “MSC Evil Twin” technique let the group deploy payloads including info-stealers (EncryptHub stealer, Rhadamanthys) and backdoors. This case highlights how ransomware gangs are increasingly using zero-day exploits to infiltrate organizations. Microsoft’s Patch Tuesday fix is available, and businesses are urged to apply it given active exploitation.

Corporate Espionage Group Turns to Ransomware:

 In an unusual crossover, the corporate espionage crew known as RedCurl has started using ransomware in some attacks. Active since 2018, RedCurl traditionally focused on stealthy data theft from global companies. However, new research by Bitdefender observed RedCurl deploying a custom ransomware dubbed “QWCrypt” to encrypt files on victims’ Hyper-V virtual servers. In a recent case, RedCurl hackers broke from their normal playbook of long-term espionage and unleashed ransomware, marking the first such instance for the group. The attack chain began with phishing emails carrying malicious .IMG attachments (disguised as job resumes) to infect systems. Once inside, the attackers leveraged “living-off-the-land” techniques and a custom lateral movement tool to avoid detection. The QWCrypt malware is tailored for virtual environments (with options to shut down or exclude certain VMs) and adds a “.locked$” extension to encrypted files. Notably, RedCurl does not operate a public leak site, fueling speculation that their use of ransomware may be intended as a false-flag distraction or for pure disruption rather than typical double-extortion. This development blurs the line between state-linked espionage and financially motivated cybercrime.

NYU Admissions Data Leak via Website Defacement:

 Over one million New York University applicants had personal data exposed in a brazen breach of the university’s website. On March 22, a hacker group took control of NYU’s homepage for roughly three hours, replacing it with charts and links to admissions datasets sorted by race. The attacker claimed to have redacted identifying details, but in reality a vast amount of PII was leaked – including names, addresses, phone numbers, emails, GPAs, and more dating back decades. NYU’s IT team worked with an outside consultant to quickly regain control of the site and is now notifying affected individuals per legal requirements. The hacker, who asserted affiliation with a group called “Computer Niggy Exploitation,” said the attack was a protest of U.S. college affirmative action policies. They similarly breached the University of Minnesota last year, leaking millions of student Social Security numbers in an anti-affirmative-action stunt. Despite the attacker’s claimed social motive, the incident is being investigated by law enforcement and highlights serious security gaps in NYU’s web infrastructure.

StreamElements Third-Party Breach Exposes Creators:

 Streaming services provider StreamElements disclosed that a breach at one of its former third-party vendors led to a leak of streamer data. On a hacking forum last week, a threat actor posted samples of data for 210,000 StreamElements users, including names, email addresses, physical addresses, and phone numbers. The hacker (alias “victim”) claimed to have infected a StreamElements employee’s machine with malware, using stolen credentials to access an old order management database from 2020–2024. StreamElements confirmed that while its own servers were not compromised, the outdated data stored with a retired partner was exposed. Affected users are being contacted, and all users have been warned to watch out for phishing scams – in fact, opportunistic attackers are already sending fake “data breach” notification emails to exploit the situation. The original forum post offering the data has since been deleted, and StreamElements is investigating alongside law enforcement while accelerating efforts to securely dispose of legacy data.

DeFi Platform Heist – $13M Stolen from Abracadabra Finance:

 Decentralized finance platform Abracadabra Finance suffered a cryptocurrency heist on March 25, with hackers siphoning nearly $13 million worth of crypto from its protocol. The attack targeted Abracadabra’s “cauldron” lending pools – smart contracts allowing users to borrow against crypto collateral – exploiting a flaw that allowed draining of funds. The team acknowledged the incident on social media and froze the affected functionality pending investigation. Blockchain security firms traced the theft of 6,260 ETH (roughly $12.9M) during the attack. In response, Abracadabra offered the thief a bug bounty worth 20% of the stolen amount (~$2.6M) if they return the rest. The platform’s front-end website was temporarily replaced with a notice of unavailability, indicating the developers were in crisis mode. Multiple security analysts linked the exploit to interactions with the GMX decentralized exchange (whose tokens were used as collateral), though GMX stated its own contracts were not compromised. The incident is one of the larger DeFi thefts of 2025 so far, and Abracadabra is working with blockchain forensics (including Chainalysis) to track the stolen funds. Notably, the attacker funded the initial exploit via the Tornado Cash mixer – just days after U.S. courts lifted sanctions on that service.

Software Supply Chain Attacks and Vulnerabilities

Malicious npm Packages Backdoor Ethereum Library:

 Security researchers at ReversingLabs uncovered a novel malware campaign targeting software developers via the npm package repository. Two rogue packages named “ethers-provider2” and “ethers providerz” were uploaded to npm, masquerading as harmless tools, but in fact they hijack a widely used library called ethers (an Ethereum blockchain toolkit) by covertly adding a malicious patch. Once a developer inadvertently installs these packages, they silently modify the local ethers module by inserting a malicious file, effectively opening a backdoor on the developer’s system. Uniquely, the attack doesn’t directly install malware; instead it piggybacks on legitimate code already present, a stealth tactic that evades many scans. The malware erases its installation traces (like temporary files) to avoid detection, and even if the fake package is removed, the poisoned ethers library can persist or re-infect if reinstalled. In the final stage, the altered library establishes a reverse shell connection, granting the attackers full remote control over the developer’s machine. The npm security team has since removed at least one of the malicious packages, and additional related packages were identified and taken down. Developers are advised to check their projects for the indicators published by ReversingLabs (including a YARA rule) to ensure their environment hasn’t been compromised, underscoring the ongoing risks in the software supply chain.

Unpatched Flaws in Industrial Cameras (ICS):

 Researchers warned of serious unpatched vulnerabilities in production-line monitoring cameras made by Japan’s Inaba Denki Sangyo. The affected device, the Inaba Choco Tei Watcher Mini (model IB-MCT001), is used in factories to oversee manufacturing processes. Four types of security weaknesses were identified, including weak default password requirements, a client-side authentication loophole, and a “forced browsing” flaw that allows access to protected pages without login. An attacker with network access to a camera can potentially take full control of the device – viewing live video/audio feeds and even manipulating or deleting stored footage. This raises both espionage and safety concerns: intruders could spy on proprietary production techniques or erase incident footage to cover sabotage. No firmware patch is yet available; Inaba has only issued mitigations, advising customers to restrict network access to the cameras and use firewalls. The U.S. CISA and Japan’s JPCERT have posted advisories since these cameras are deployed globally, not just in Japan. Affected industries are urged to apply network segmentation and monitor these devices closely until Inaba releases fixes, as compromised industrial cameras could facilitate broader attacks on factory networks.

Period-Tracking App Data Misuse (Flurry/Flo Health):

 In a notable privacy case, Flurry Inc., a now-defunct mobile analytics firm, agreed to pay $3.5 million to settle allegations that it illicitly harvested sensitive health data from a popular period-tracking app. According to a class-action lawsuit, Flurry’s software (embedded in the Flo Health menstruation app) collected users’ personal and sexual health details without proper consent and shared them with third parties like Meta and Google. Millions of women who used the Flo app between 2016 and 2019 had provided intimate information – from menstrual cycles and fertility intentions to whether they experience pain during sex – under the impression it would remain private. The complaint alleged Flurry’s SDK enabled surreptitious access to this data, violating user trust and privacy laws. The settlement, approved in a California federal court last week, addresses Flurry’s liability (other defendants like Meta are handled separately). Affected users will be notified as part of the class settlement. This case underscores growing  concerns around health apps and data brokers: regulators are increasingly cracking down on the improper sharing of personal health information, even in the absence of a traditional data “breach.” Flurry’s penalty serves as a reminder that cybersecurity isn’t just about external hackers – it also covers the accountability of organizations in handling sensitive user data responsibly.

 The Hacker News; BleepingComputer; The Record (Recorded Future); SecurityWeek; Hackread; South China Morning Post; official statements and advisories

Stay updated on the latest cyber threats, including nation-state espionage, ransomware attacks, zero-day exploits, and data breaches. Learn how APT groups and cybercriminals are evolving their tactics.

Cyber Threat Report: Nation-State Espionage, Ransomware, and Emerging Cybercrime Trends

Two critical vulnerabilities in Cisco’s Smart Licensing Utility (versions 2.0.0, 2.1.0, 2.2.0) are under active attack after patches were issued last year​. The flaws (CVE-2024-20439 and CVE-2024-20440, both CVSS 9.8) include a hidden admin credential and an overly verbose debug log that leaks credentials, potentially letting attackers log in with full privileges and harvest sensitive API keys​. Cisco fixed the issues in September 2024, but systems running unpatched versions remain at risk if the licensing service is active​. The SANS Internet Storm Center warns that ongoing exploitation attempts could lead to complete system compromise on vulnerable Cisco servers​. 

 Organizations using Cisco Smart License Utility should update to version 2.3.0 or later immediately to prevent unauthorized admin access and data theft.

Oracle Denies Data Breach Claims After 6M Records Put on Sale

Oracle is refuting a hacker’s claim of breaching its systems and stealing 6 million customer records from its Oracle Cloud identity service​. The threat actor “rose87168” released samples (including LDAP info and company lists) and even uploaded a proof-of-access text file to an Oracle Cloud server, alleging they exfiltrated encrypted SSO passwords, keystore files, and other credentials​. Oracle told the press “There has been no breach of Oracle Cloud… No Oracle Cloud customers experienced a breach or lost data”​. The hacker is attempting to sell the data or trade it for zero-day exploits on a criminal forum​. Oracle has not explained how the attacker managed to place a file on an Oracle server if no breach occurred​. 

If the hacker’s claims are true, the stolen credentials could enable further
intrusions. Oracle’s strong denial suggests either a false claim or a very limited exposure, but customers are on alert pending more details.

Coinbase Targeted in GitHub Supply Chain Attack

Researchers revealed that cryptocurrency exchange Coinbase was the prime target of a sophisticated supply-chain attack on GitHub Actions that compromised continuous  integration (CI) workflows​. Attackers injected malicious code into a popular open-source GitHub Action (reviewdog/action-setup@v1), causing hundreds of projects’ CI secrets to leak into build logs​. Notably, the attackers focused the attack on Coinbase’s repositories: when Coinbase’s agentkit project ran a workflow that pulled the tampered action, it exposed a token that hackers used to push a malicious change into another dependency​. Coinbase told investigators the attempt was unsuccessful and caused no damage to their systems or the AgentKit project​. Only 218 repositories in total had secrets stolen (out of 23,000 that used the affected action) before GitHub and security teams shut down the campaign​. 

The incident highlights the dangers of software supply-chain attacks on developer tools. Coinbase’s quick response limited damage, but other organizations are urged to audit CI/CD pipelines and rotate any credentials that might have been exposed. 

Malicious Steam Game Demo Infects Players with Info-Stealer

Valve has pulled a game demo from Steam after multiple users reported it contained malware that stole information from their PCs​. The demo, for a shooter titled 

, prompted players to download an installer from an off-platform GitHub repository – a red flag since legitimate Steam games don’t require external downloads​. Tech-savvy users analyzed the installer and found it included a Windows Defender spoof, privilege escalation tools, a Node.js-based cookie interceptor, and scripts for persistence​. In short, running the demo infected players with an info-stealing Trojan. GitHub quickly removed the attacker’s repository, and by Thursday Valve had also banned the game and its developer from Steam​. The malicious developer’s own website went offline, and Steam advised anyone who ran the demo to uninstall it and scan their system for malware​. 

 This incident – just a month after a similar malware-laced “game” on Steam (PirateFi) infected up to 1,500 users – underscores the risk of attackers sneaking malware onto trusted platforms​. Gamers should exercise caution even on official stores, and Steam is likely to tighten its vetting to prevent repeats.

Phishing Campaign Spoofs Semrush to Hijack Google Accounts

A crafty new phishing and malvertising campaign is targeting digital marketers by impersonating Semrush, a popular SEO and marketing SaaS platform, in order to steal Google account credentials​. Fraudsters are placing fake Google Ads for “Semrush” that redirect SEO professionals to a lookalike Semrush login page, tricking them into entering Google login details​. According to researchers at Malwarebytes and an SEO firm, the attackers likely aim to compromise victims’ Google Ads and Analytics accounts, which are often linked with Semrush for business insights​. This “cascading fraud” approach was seen earlier in the year using fake Google Sites, and the threat group – reportedly based in Brazil – has now switched to abusing the Semrush brand for credibility​. By hijacking one professional’s Google account, the attackers can run malicious ads from that account to ensnare even more victims, creating a widening spiral of compromised accounts​. 

 High-value Google accounts (with access to ad campaigns, web analytics, and revenue data) are at stake. Companies are advised to verify they are clicking genuine ads or navigate directly to service URLs, and use multi-factor authentication on Google accounts to mitigate credential theft.

U.S. Lifts Sanctions on Tornado Cash Mixer after Court Ruling

In a significant policy reversal, the U.S. Treasury Department has removed the sanctions on Tornado Cash, an Ethereum coin mixer that had been blacklisted for abetting North Korean hackers. OFAC originally sanctioned Tornado Cash in August 2022, alleging it helped launder over $7 billion in illicit crypto, including $455 million stolen by North Korea’s Lazarus Group from the Axie Infinity/Ronin hack​. However, a federal appeals court ruled in November 2024 that sanctioning Tornado Cash (essentially open-source software) exceeded OFAC’s  authority​. As a result, Treasury announced that it would comply with the ruling and delist Tornado Cash from the sanctions list​. The mixer had been a go-to tool for criminals to obscure crypto transactions – beyond the North Korean heists, it was used to launder millions from the Nomad bridge and Harmony Bridge hacks as well​. 

 The desanctioning is a win for crypto privacy advocates and developers, but it raises concerns among law enforcement. North Korea and other threat actors lost a major laundering avenue when Tornado was banned; its return could renew illicit use​. The case also sets a precedent limiting the U.S. government’s reach in sanctioning decentralized code platforms, likely influencing how authorities tackle cryptocurrency crime going forward.

Arrests Made in Tap-to-Pay Phishing Fraud Scheme

U.S. authorities announced the first-ever arrests in a new kind of tap-to-pay fraud that bridges online phishing and in-store theft​. In Knox County, Tennessee, 11 individuals (all Chinese nationals) were arrested for allegedly using phishing-powered mobile wallets to buy tens of thousands of dollars in gift cards with other people’s credit cards​. According to investigators, the group obtained stolen card data by running phishing scams – for example, sending fake texts about postal fees or toll charges to trick victims into entering card info (bypassing cell carriers via email-to-SMS kits)​. The scammers then loaded that stolen card data into mobile payment apps on Android devices, effectively creating fraudulent Apple Pay/Google Pay wallets​. Using a custom Android app, they could make these phones impersonate tap-to-pay cards at retail stores across different states​. During the Tennessee operation, police recovered over $23,000 in gift cards bought with the compromised card data​. 

This scheme shows the evolution of classic card fraud into the mobile era – phished data is turned into contactless payment clones, making detection harder. The busts in Tennessee (and a similar case in Arkansas) suggest law enforcement is catching on, but other cells may still be exploiting this method nationwide​. Retailers are advised to train staff to spot suspicious bulk gift card purchases, and consumers should be wary of unsolicited texts asking for payments or personal info.

Israeli “Paragon” Spyware Used Against Journalists and NGOs

A new investigation reveals that advanced spyware developed by Israeli firm Paragon Solutions has been deployed against members of civil society in multiple democracies​. On January 31, WhatsApp alerted more than 90 individuals that their devices were targeted by this sophisticated malware, which infects smartphones via messaging apps​. Citizen Lab researchers, working with some of the victims, have since detailed how the spyware operates and identified some of the governments behind it​. Branded as “Paragon” (no relation to NSO Group’s Pegasus, but similar in capability), the spyware can covertly surveil both Android and iOS devices, extracting messages and turning on cameras/mics without detection. Disturbingly, the clients using Paragon include law enforcement or intelligence agencies in democratic countries, not just authoritarian regimes​. One researcher noted, “Real governments are in fact using [this] spyware against... citizens. It’s a crazy time to be alive,” highlighting how even nations with strong rule of law are tempted by such tools. 

The  discovery of Paragon’s use on journalists and aid workers raises fresh concerns about oversight of cyber-surveillance tech. It underscores a growing trend of mercenary spyware being sold globally and potentially abused, prompting calls for stricter regulation and for potential targets to secure their communications (e.g. using up-to-date devices and enabling safety features like WhatsApp’s alerts for unknown device links).

CISA Red-Team Cuts Spark Concerns for U.S. Cyber Defense

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is grappling with internal turmoil after widespread contract cuts that hit its elite “red team” units​. Under a cost-cutting initiative led by Elon Musk – who heads the new Department of Government Efficiency (DOGE) in the current administration – hundreds of DHS cybersecurity contractors were let go in late February, including those supporting CISA’s threat-hunting and red-teaming operations​. CISA clarified in a statement that it technically didn’t “lay off” these security experts but simply 

, effectively sidelining entire teams that simulate cyberattacks to probe U.S. government and critical infrastructure defenses​. The move came amid an administration-wide purge of probationary federal employees (a controversial action later reversed by court order) and budget-driven downsizing at cyber agencies. Security professionals are alarmed – one DHS red-team leader’s LinkedIn post about his contract getting axed drew dozens of recruiters eager to poach the talent​. Observers warn that dismantling or pausing CISA’s red teams could create intelligence blind spots, as these teams often discover emerging threats and vulnerabilities that agencies and industry rely on​. 

 Slashing cyber defense programs in the name of efficiency may save money short-term but increases the risk of undetected breaches long-term. Lawmakers and CISA’s leadership are reportedly pushing to restore funding to these operations, noting that any lapse in proactive testing leaves the nation’s networks more exposed to adversaries.

New APT Uncovered Targeting Taiwan’s Infrastructure

Cisco Talos researchers have identified a previously unknown advanced threat actor, UAT-5918, that has been infiltrating critical infrastructure in Taiwan since at least 2023​. This group appears focused on long-term espionage: it exploits known (unpatched) vulnerabilities in internet-facing servers to gain an initial foothold, then plants web shells and employs open-source hacking tools to move laterally and harvest credentials and data​. UAT-5918 has hit not only government infrastructure but also telecom, IT, academic, and healthcare targets in Taiwan​. Investigators believe it’s a nation-state APT motivated by intelligence gathering – the group’s tactics overlap with techniques used by several Chinese state-aligned hacking crews (Volt Typhoon, Flax Typhoon, Tropic Trooper, etc.)​. Notably, the intrusions emphasize stealth and persistence over destruction: the attackers maintain backdoors for long-term access, potentially siphoning sensitive info for months. Impact: Taiwan has long been in the crosshairs of Chinese cyber-espionage, and the emergence of UAT-5918 shows continued adaptation by threat actors to evade detection. Taiwanese organizations are urged to patch known flaws promptly and look for signs of these post-compromise tools. Given the overlaps with known Chinese operations, this discovery also helps global defenders recognize and attribute similar tactics in their networks. 

Unlikely Alliance: Hackers “Head Mare” and “Twelve” Join Forces Against Russia

In an unusual twist, a pair of cybercrime groups are collaborating to attack Russian organizations, according to new findings by Kaspersky Lab​. The two threat clusters, codenamed “Head Mare” and “Twelve,” were previously seen as separate actors but now appear to be running joint campaigns against Russian targets​. Evidence of the alliance comes from shared infrastructure and tools: Head Mare’s recent attacks have leveraged command-and-control servers that were exclusively used by Twelve in the past, and they’ve started using hacking implants (like the CobInt backdoor) known to be favored by Twelve​. Last year, Head Mare was observed exploiting a WinRAR vulnerability (CVE-2023-38831) to gain initial access, then deploying malware and even ransomware (LockBit on Windows, Babuk on Linux/VMware ESXi) on Russian companies for profit​. Twelve, meanwhile, has a reputation for more destructive attacks – using off-the-shelf tools to encrypt data and then wiping systems to cripple victims, rather than extort​. The convergence of these tactics suggests the groups may be pooling resources or coordinating operations. 

 Russian entities, including businesses or perhaps government agencies, are facing a compounded threat from this collaboration. It’s somewhat rare to see cyber gangs team up across different modus operandi, especially to hit Russian targets (as many cybercriminals operate from Russia with tacit tolerance). This could signal shifting dynamics – possibly retaliation by pro-Ukraine or other actors – and indicates that even well-resourced threat groups are not beyond forming alliances to achieve their goals. Russian organizations are advised to apply the WinRAR patch from last year and strengthen monitoring for known malware associated with these groups.

Medusa Ransomware Deploys Malicious Driver to Disable Antivirus

Medusa, a ransomware-as-a-service gang active since 2021, has been caught using an unusually aggressive technique to evade endpoint defenses​. In a recent incident analyzed by Elastic Security Labs, Medusa operators installed a malicious Windows driver (dubbed “ABYSSWORKER”) on the victim machine as part of the attack chain​. This is a classic “bring your own vulnerable driver” (BYOVD) approach: the driver was signed with a stolen digital certificate from a legitimate Chinese hardware vendor but had been revoked due to known security issues​. Once loaded, the rogue driver (masquerading as a CrowdStrike Falcon anti-malware driver) effectively shut down the system’s antivirus and EDR (endpoint detection & response) protections, clearing the way for Medusa’s file-encrypting payload to run unhindered​. Dozens of samples of this driver, 

, have appeared on VirusTotal since August 2024, indicating the tactic has been in testing or use for months​. All the samples were signed with various compromised certificates from Chinese companies, suggesting the attackers have a supply of leaked certs to rotate through​. 

This development shows ransomware actors upping their game by adopting tactics more often seen in state-sponsored attacks. A signed driver can bypass a lot of security controls because it appears trustworthy to the OS – until it starts killing processes. Organizations should ensure their devices block known vulnerable or revoked drivers (Microsoft’s Windows driver blocklist can help) and monitor for unusual driver installation activity. The Medusa attack also underlines the importance of having multiple layers of defense; even if EDR is blinded, network monitoring or anomaly detection might catch the attack before data is encrypted.

Critical vulnerabilities in Cisco Smart Licensing Utility (CVE-2024-20439, CVE-2024-20440) are under active attack, putting unpatched systems at risk. Learn how to protect your network now.

Cisco Smart Licensing Flaws Under Attack: Critical Vulnerabilities Leave Unpatched Systems Exposed

A new threat actor, HellCat, has been breaching global organizations by hijacking Atlassian Jira servers through stolen credentials. Notably, Swiss tech firm Ascom confirmed HellCat accessed their Jira ticketing system, exfiltrating around 44GB of sensitive data including source code, project documentation, invoices, and confidential records. HellCat previously compromised major firms such as Schneider Electric, Telefónica, and Orange Group, exploiting internet-facing Jira systems. Recently, the group targeted U.S. marketing firm Affinitiv, extracting databases containing approximately 470,000 unique emails and 780,000 records. The common entry method involved credentials obtained through infostealer malware, exemplified by the Jaguar Land Rover incident, where HellCat used credentials from an LG Electronics contractor with prolonged exposure. This underscores the critical supply-chain risks where compromised third-party credentials become backdoors to larger networks. Companies are advised to audit external vendor credentials, enforce multi-factor authentication (MFA), and implement rigorous access controls and monitoring on collaboration platforms like Jira.

Pennsylvania State Education Association (PSEA) Breach by Rhysida Ransomware

The Pennsylvania State Education Association experienced a significant breach impacting over 517,000 individuals. Initially occurring in July 2024 but only recently fully investigated, attackers stole sensitive personal information such as Social Security numbers, driver’s licenses, financial details, and health data. The Rhysida ransomware gang claimed responsibility, initially demanding a 20 Bitcoin (~$500,000) ransom, and later removing PSEA's data from their leak site, implying potential ransom negotiations or payment. The extended delay in detection emphasizes the challenges organizations face in promptly identifying data exfiltration, particularly when attackers remain covert. It also highlights the need for encrypting sensitive data and limiting data access through least-privilege practices.

Ransomware-as-a-Service (RaaS) Developments and 'Betruger' Malware

RansomHub, a prominent RaaS platform, has introduced an advanced malware called Betruger, which consolidates numerous attack functionalities into a single binary. This tool captures screenshots, logs keystrokes, scans networks, dumps credentials, escalates privileges, and facilitates data exfiltration. It reduces detection likelihood by minimizing the use of multiple conspicuous tools. Symantec observed Betruger disguised as "mailer.exe" to appear benign. This innovation highlights increased ransomware sophistication and necessitates behavior-based detection strategies and robust endpoint detection and response (EDR) solutions. Ransomware attacks, including the use of Betruger and BYOVD attacks (e.g., disabling security software via vulnerable drivers), reinforce the urgency of credential hygiene and proactive security patching.

Malicious Visual Studio Code Extensions and Supply Chain Risks

Two malicious Visual Studio Code extensions were identified deploying ransomware scripts onto developers' machines. Extensions named "ahban.shiba" and "ahban.cychelloworld" remained unnoticed on Microsoft’s marketplace, embedding obfuscated PowerShell scripts downloading rudimentary ransomware. Though limited in scope, this incident underscores severe supply chain vulnerabilities when trusted marketplaces are exploited. Similar to a recent GitHub Actions compromise exposing secrets from 218 repositories, these incidents highlight the necessity for stringent extension vetting, pinning trusted versions, and monitoring extension behaviors closely. Segmented development environments and restricted extension installation policies mitigate potential damage.

Chinese Cyber-Espionage: Fish Monger (I-SOON) and Taiwanese Infrastructure Attacks

The FishMonger advanced persistent threat (APT) group, linked directly to Chinese defense contractor I-SOON, conducted espionage campaigns targeting governments, NGOs, and think tanks globally, using advanced malware like ShadowPad and SodaMaster. Additionally, Chinese-linked cyber group UAT-5918 (aligned with Volt Typhoon) targeted Taiwan’s critical infrastructure sectors such as telecom and healthcare, exploiting unpatched internet-facing servers. These campaigns illustrate the intertwined nature of espionage and infrastructure sabotage, emphasizing the importance of patch management, secure software supply chains, and proactive vulnerability assessments.

Russian Cyber Operations Targeting Ukrainian Military via Signal Messenger

Ukraine's CERT alerted to a sophisticated Russian-aligned spear-phishing campaign targeting the Ukrainian military and defense sectors through compromised Signal messenger accounts. Attackers sent malicious archives, embedding DarkCrystal RAT (DCRat) malware, masquerading as legitimate military documents. This vector shows APT adaptability beyond traditional email phishing, leveraging trusted encrypted messaging apps, underscoring the necessity for vigilance across all communication channels and robust endpoint defenses.

Windows LNK Zero-Day Exploited by Multiple APTs

A severe, unpatched Windows vulnerability involving malicious shortcut (.LNK) files has been actively exploited since 2017 by at least 11 state-sponsored APT groups, including actors from China, Russia, North Korea, and Iran. Despite being informed, Microsoft has not issued a patch, categorizing it as below their service threshold. Organizations must mitigate independently through measures like disabling shortcut executions from unknown sources, leveraging Mark-of-the-Web protections, and ensuring robust behavioral detection capabilities in endpoint defenses. 

WhatsApp Zero-Click Exploit: Paragon's "Graphite" Spyware

Meta patched a critical zero-click WhatsApp vulnerability exploited by Paragon Solutions to silently deploy spyware ("Graphite") on target devices via malicious PDF files added to group chats. The spyware breached the WhatsApp sandbox to infiltrate other device data. This incident highlights persistent vulnerabilities in encrypted messaging platforms and emphasizes regular app updates, restrictive group addition policies, and complementary secure communication tools.

Critical Vulnerabilities Exploited in Nakivo and Cisco Systems

Critical vulnerabilities in NAKIVO Backup & Replication software and Cisco’s Smart Licensing Utility are actively exploited in cyberattacks, enabling remote control and widespread system compromise. Promptly applying patches to these vulnerabilities is essential, as attackers rapidly weaponize known bugs. These incidents underscore the significance of timely updates and rigorous vulnerability management processes, especially for backup and licensing systems critical to disaster recovery.

Policy Developments and Cybersecurity Legislation

Hong Kong passed its first comprehensive cybersecurity law mandating robust security measures and breach reporting for critical infrastructure sectors. The U.S. saw an unprecedented extradition of a LockBit ransomware affiliate, marking significant international cooperation against cybercrime. Europol warned of increasing collaboration between state actors and cybercriminals (the "Shadow Alliance"), while GCHQ emphasized urgency in preparing for quantum computing threats against current cryptographic standards. These regulatory shifts underline growing cybersecurity expectations globally, influencing future compliance standards for organizations.

HellCat hackers are exploiting Atlassian Jira servers to breach global organizations, stealing sensitive data. Learn how they operate and how to protect your business."

HellCat Exploits Jira: Global Breaches and the Rising Supply Chain Threat

High-Profile Breaches and Emerging Threats

Record-Breaking Crypto Heist (Bybit Exchange): 

In the largest cryptocurrency theft to date, an 

 cold wallet​. The hacker manipulated a digital signing process to redirect funds, an attack so severe that it nearly doubled the previous record for crypto hacks . The 

, identifying it as part of the “TraderTraitor” campaign​. Despite the enormity of the theft, Bybit’s CEO assured that customer assets remain 1:1 backed and the exchange can cover the loss without disrupting operations​.

 using a compromised third-party service provider account, exposing personal information of customers, drivers, and merchants. The intruders obtained names, email addresses, phone numbers, and partial payment card data for some users, though GrubHub reports that passwords and more sensitive info (full card numbers, SSNs) were not accessed​. The breach underscores the risk of supply chain and vendor account compromises – a threat that can impact SMBs that rely on external service providers for support. GrubHub responded by terminating the vendor’s access, hiring forensic experts, and bolstering monitoring for anomalous activity.

 to inject payment skimmers, stealing customers’ credit card details over a 10-day period in January​.

 where attackers accessed an SFTP server and stole data back in late 2024​.

These incidents illustrate the global reach of cyber threats – from e-commerce sites to enterprise IT environments – and the importance of vigilant security practices across the board.

Ransomware continues to wreak havoc on organizations globally, with threat actors evolving their tactics and target profiles. Recent incidents highlight both new ransomware operations on the rise and the tangible business impacts of these attacks.

 A relatively new ransomware gang dubbed 

. In February, Sarcoma claimed responsibility for an attack on Unimicron, one of the world’s largest PCB (printed circuit board) manufacturers based in Taiwan​. The attackers leaked proof of stolen files and threatened to release 377 GB of data – including databases and documents – if the ransom was not paid within a week​. Unimicron confirmed a ransomware incident causing operational disruption at a subsidiary, though it has not publicly confirmed the data theft​. Sarcoma’s rapid rise is notable: the group launched its first attacks in late 2024 and was already claiming dozens of victims within months, using phishing and known vulnerabilities to gain entry​. Security researchers warn that Sarcoma employs aggressive tactics, including supply-chain attacks (hacking service providers to reach clients) and extensive data exfiltration​.

 Established ransomware operators also remain active: 

, for example, was behind a major attack on UK’s Southern Water in 2024, and the utility disclosed incurring £4.5M (~$5.7M) in incident-related costs​.

 – a notable incident involved a Siberian dairy plant hit by a LockBit strain, reportedly in retaliation for the company’s support of Russian military efforts​.

This hints at the blurring lines between financially motivated ransomware and politically driven attacks. Additionally, a new 

 in late 2024), showing that even months-old intrusions can reveal new ransomware strains.


Ransomware’s impact on victims is often crippling. In the United States, 

 (an SMB-scale tribal government) knocked critical services offline, including health clinics, government offices, and five casino locations​. The tribe had to temporarily close departments, cancel medical appointments, and halt casino operations, severely disrupting the community’s daily life and revenue. This case exemplifies how SMBs and local governments can be gravely affected – the tribe’s size (serving ~44,000 members) and reliance on IT systems for healthcare and business made it a tempting target, even if it’s not a Fortune 500 company​. Many such organizations face limited cybersecurity budgets, making them attractive marks for ransomware gangs. The Sault Tribe attack also highlights the real-world consequences of ransomware beyond data encryption – affecting public safety, healthcare, and economic livelihoods.

Evolving Tactics – Double Extortion and More:


Nearly all modern ransomware incidents now involve data theft (double extortion), where attackers exfiltrate sensitive information to pressure victims into paying. The 

: stolen data was used as leverage by threatening publication​. Some groups have gone further to triple extortion – adding threats of DDoS attacks or directly harassing victims’ clients if the ransom isn’t paid. We also see ransomware groups tailoring their exploits: for instance, Sarcoma has leveraged 

-day vulnerabilities and even infiltrated service providers to “island hop” into downstream victims​. These advanced tactics underscore that ransomware actors are not just encrypting files at random; they often conduct network reconnaissance, steal credentials, and sometimes maintain persistence to strike again.

Ransomware remains one of the top threats to businesses worldwide. New groups like Sarcoma can emerge rapidly, so organizations should not assume lesser-known names are low risk. SMBs, in particular, must recognize they are not “too small” to target – attackers often perceive smaller entities (municipal bodies, regional businesses, etc.) as softer targets. Defenses such as robust data backup strategies, network segmentation, regular patching of known vulnerabilities, and user training to resist phishing are essential. Additionally, having an incident response plan (including communication and recovery) is critical, as evidenced by the costly and disruptive outcomes in recent cases.

State-Sponsored APT Activity & Cyber Espionage

Nation-state threat actors (APT groups) continue to orchestrate sophisticated cyber-espionage campaigns and exploit zero-day vulnerabilities. Recent developments reveal a mix of new exploit techniques and long-running operations by APT groups from North Korea, Russia, China, Iran, and others:

Widely Exploited Windows Zero-Day (LNK vulnerability): 

One of the most alarming reports this week is that at least 11 state-sponsored groups have been actively exploiting an unpatched Windows vulnerability that abuses shortcut (.lnk) files​. This flaw 

 allows a malicious .lnk file to execute hidden commands when viewed in Windows, enabling stealthy installation of malware. Remarkably, the vulnerability has been under active attack since 2017 and remains unpatched by Microsoft as of this report​. Threat actors from North Korea, Iran, Russia, China, and others are leveraging this bug to deliver spyware and steal data from targets in government, finance, telecom, military, and energy sectors. Notable malware delivered via these .lnk exploits include the Lumma infostealer and Remcos RAT, among other payloads​. Microsoft has stated the issue did not meet the bar for an emergency fix (per their severity guidelines) and indicated it may be addressed in a future update​ – a stance that has drawn criticism from security experts, given the ongoing espionage activity​. In the meantime, defenders are urged to mitigate: scan for malicious .lnk files, increase user caution around shortcuts, and ensure endpoint protection is alert to this behavior​.

The widespread abuse of this .lnk zero-day underscores how global and far-reaching APT campaigns can be. 

 shows malicious shortcut files tied to this exploit have been observed across North America, Europe, Asia, South America, Africa, and
Australia​.

, with significant activity also from Iranian, Russian, and Chinese groups​. High-profile APTs like Kimsuky (North Korea), Mustang Panda (China), Bitter (South Asia), and even financially-motivated Evil Corp (Russia) are among those abusing the vulnerability​.The diversity of actors and victims reveals how a single unpatched flaw can become a common tool for espionage across ideologies – from stealing military intel to conducting financial theft. For SMBs, this might seem like a nation-state issue, but if your organization falls into a supply chain or industry of interest, you could become collateral damage. Moreover, some cybercriminal groups (non-state) are also exploiting it, meaning even businesses without geopolitical significance might be targeted for financial gain​.

Russian “BadPilot” Campaign – APT44/Sandworm: 

Microsoft investigators have exposed a multi-year campaign dubbed “BadPilot” by a 

. This subgroup specializes in initial access operations: breaching networks in critical sectors and establishing backdoors, which are then handed off to other teams for exploitation and possibly destructive attacks​. Active since at least 2021, BadPilot has targeted organizations in energy, oil & gas, telecommunications, shipping, arms manufacturing, and critical infrastructure across roughly 50 countries (including Ukraine, the U.S., and U.K.)​. Their playbook involves exploiting public-facing vulnerabilities to break in, then maintaining persistence so that Russian operators can later conduct espionage or sabotage (including observed wiper attacks to destroy data)​. Notably, BadPilot’s activity ramped up around Russia’s 2022 invasion of Ukraine, focusing on entities supporting Ukraine’s operations​. This campaign illustrates the patient, coordinated approach of state-backed hackers – one team lays the groundwork (often quietly persisting for months), enabling follow-on forces to carry out high-impact actions at will. For defenders, the lesson is to monitor for initial footholds (e.g. unusual admin accounts, scheduled tasks, web shell activity) that might indicate an APT staging access for later use. Swift eradication of such footholds can blunt a future attack.

 Security researchers at Elastic uncovered a stealthy malware toolset in an 

, showcasing APT creativity in avoiding detection​. The malware, called FinalDraft, uses an unconventional Command-and-Control (C2) channel via Microsoft Outlook: it hijacks the victim’s Outlook email drafts folder to exchange commands and data with the attackers​. By abusing the legitimate Outlook/Exchange service (through the Microsoft Graph API), FinalDraft’s communications blend into normal email traffic, making it very hard for network defenders to spot. The attack chain begins with a custom loader (“PathLoader”) that plants the FinalDraft backdoor and post-exploitation tools on the target machine​. Once running, FinalDraft obtains an OAuth token for the victim’s Office 365 account and uses it to continuously sync with a hidden mailbox – receiving attacker instructions concealed as draft messages and exfiltrating data by saving drafts in return​. No actual emails are sent, so traditional email security solutions see nothing amiss. This novel technique exemplifies the lengths APT actors will go for covert persistence. It’s a reminder that even trusted cloud services can be bent to an attacker’s purpose. Defenders should consider monitoring for unusual usage patterns of APIs (like Graph), and ensure cloud audit logs are collected – such abuse might only be discernible by anomalies in logins or token usage rather than network traffic.

 – beyond the headline-grabbing crypto heist mentioned earlier, Pyongyang-linked groups (e.g. Lazarus) continue targeting financial institutions and cryptocurrency platforms, as well as traditional espionage targets. Iran’s government-affiliated hackers are reportedly among those exploiting the Windows shortcut flaw​, and Iranian APTs have shown interest in infrastructure and dissident surveillance. Chinese espionage groups have been linked to numerous campaigns: for example, 

 , and other Chinese units have exploited networking equipment vulnerabilities for spying on telcos and ISPs. Finally, Russian actors (apart from Sandworm) such as APT28 were implicated in cloud service breaches (like the one affecting HPE’s email system​) – indicating that even well-secured enterprises can fall victim to token theft or credential compromise in their SaaS environments.

Critical Vulnerabilities & Patches (March 2025)

Staying ahead of vulnerabilities is a never-ending challenge for security teams. March 2025 has already seen a surge in patches for actively exploited flaws and warnings of new weaknesses affecting both enterprise and SMB products. Below is a roundup of important vulnerabilities and vendor advisories:

Microsoft’s Patch Tuesday – 6 Zero-Days Fixed: 

Microsoft’s March 2025 security update was unusually large, addressing 57 vulnerabilities including 6 zero-days under active attack​. This is the second-highest number of in-the-wild zero-day fixes ever released by Microsoft in one go​. Notably, three zero-day bugs in the Windows NTFS file system were patched (two info leaks and one remote code execution)​. The most severe, CVE-2025-24993, is a heap overflow that could let an attacker with basic access run code with elevated privileges​. Microsoft also patched CVE-2025-24985, an RCE in the legacy FAT file system driver that can be triggered remotely via a malicious USB or network drive. Another critical issue, CVE-2025-26633, is a security feature bypass in the Microsoft Management Console – it could allow attackers to craft malicious configuration files that evade certain security checks. These vulnerabilities, if chained together, could enable a sophisticated attacker to escalate from a simple foothold to full system compromise​. Takeaway: Apply the March patches immediately, prioritizing client systems and servers, as threat actors will likely reverse-engineer these fixes to target unpatched machines. The high volume of patched zero-days suggests attackers were actively exploiting Windows components that many organizations (and SMBs) rely on daily.

Outside of Microsoft, other critical zero-day patches were released recently. Apple issued emergency updates in February to fix a WebKit/Safari vulnerability (CVE-2025-24200) that was being exploited in “extremely sophisticated” targeted attacks​. This underscores that macOS and iOS devices – often used by executives – are also in attackers’ crosshairs. Meanwhile, the Android ecosystem saw a kernel privilege escalation bug (CVE-2024-53104) patched after it was found exploited in the wild​. Security teams should ensure mobile device management (MDM) solutions prompt updates on employee devices, as mobile zero-days are valuable for espionage.

SMB-Focused Threat: Vulnerable Firewalls and VPNs:

 Small and mid-sized businesses often rely on affordable firewall/VPN appliances, which have recently been under attack. One headline issue is a critical RCE in GFI Kerio Control firewalls (CVE-2024-52875) – over 12,000 firewall instances were found exposed online and vulnerable. Exploiting this bug could let attackers completely hijack an SMB’s network gateway, leading to data theft or ransomware deployment. Similarly, SonicWall warned that attackers began targeting an authentication bypass flaw (CVE-2024-53704) in SonicWall appliances just days after a PoC exploit was published​. And it’s not just smaller vendors: Palo Alto Networks alerted customers that hackers are chaining multiple bugs (CVE-2025-0111 with others) to breach PAN-OS firewall devices, bypassing auth and reading sensitive files​. These network device vulnerabilities are a huge concern – many SMBs depend on these all-in-one security boxes, which if compromised, give attackers a foothold at the network perimeter. Recommendation: Immediately apply patches or mitigation for any network appliances in use. If a device is end-of-life and no patches are provided, consider isolating or replacing it. Monitor vendor advisories (from companies like Fortinet, Cisco, SonicWall, Palo Alto, etc.) as attackers watch them closely and often exploit new bugs within hours or days of disclosure.

Stay ahead of cyber threats with key insights on major breaches, ransomware, and emerging risks. Learn about the Bybit heist, GrubHub breach, new ransomware groups, and APT activity. Protect your business with expert analysis and security best practices.

Cyber Threats on the Rise: Record Crypto Heists, Ransomware Evolution, and State-Sponsored Espionage

Christine Davis

Director, Marketing

We are thrilled to announce that Stellar has been named to CRN’s 

 earning this prestigious recognition, and we couldn’t be more honored.

, highlights the top Managed Service Providers that are driving growth, innovation, and success for businesses through cutting-edge IT solutions. The 

 category specifically recognizes MSPs with a strong focus on the SMB market, helping organizations optimize their IT infrastructure and security.

At Stellar, our commitment to delivering top-tier 

cybersecurity, cloud, and managed IT solutions

 remains stronger than ever. This award is a testament to our dedicated team and our valued clients who trust us to protect and empower their businesses.

We look forward to another year of innovation and excellence in the ever-evolving IT landscape. 

Thank you to CRN for this recognition and to our incredible team and clients for making this possible!

2025_CRN_MSP 500_vertical.png

Stellar Awarded Pioneer 250 on CRN's MSP 500 List for 2025

Stellar Recognized on CRN's 2025 MSP 500 List for the Second Year in a Row

As we step into 2025, technology continues to evolve at an unprecedented pace, reshaping industries and redefining the way we live and work. From advancements in artificial intelligence to breakthroughs in quantum computing, the year promises to be a landmark in innovation. Here are the top five technology trends set to dominate 2025:

Generative AI tools, like ChatGPT and other large language models, have evolved from experimental technologies to essential tools for businesses and individuals. In 2025, their applications extend beyond content creation to include:

Businesses are integrating generative AI into workflows to boost productivity, while individuals leverage it for personalized assistance. With advancements in ethical AI frameworks, concerns around misuse are being actively addressed, paving the way for broader adoption.

After years of promise, quantum computing is finally making significant strides in 2025. Companies like IBM, Google, and startups are achieving milestones in quantum supremacy. Key developments include:

While still in its infancy for widespread use, quantum computing’s potential to solve problems at an unimaginable scale is closer than ever.

The combination of edge computing and artificial intelligence is supercharging the Internet of Things (IoT). Edge AI allows devices to process data locally, minimizing latency and enhancing privacy. In 2025, expect:

This shift reduces dependence on centralized cloud systems and opens new possibilities for industries requiring real-time data processing.

The concept of the metaverse is evolving into a more practical and accessible reality. Unlike the hype-driven initial wave, Metaverse 2.0 focuses on:

Advances in hardware, such as lighter VR headsets and higher-quality AR glasses, are driving adoption, while blockchain ensures secure ownership of digital assets.

Green Tech and Sustainability Innovations

Sustainability is no longer a buzzword but a core focus of technological innovation in 2025. Key trends include:

Tech companies are prioritizing net-zero goals, with AI-driven tools optimizing resource management and sustainable product design.

The technology trends of 2025 promise to transform industries, enhance daily life, and address global challenges. Whether it’s the power of quantum computing or the promise of greener tech, these innovations underline a common theme: harnessing technology responsibly to build a better future. Staying ahead of these trends will be key for businesses and individuals alike to thrive in this dynamic landscape.

The Top 5 Technology Trends to Watch in 2025 

Artificial Intelligence (AI) has made significant strides in recent years, especially in its ability to imitate human voices with remarkable accuracy. This technological advancement, while offering exciting possibilities in entertainment, customer service, and accessibility, also presents new challenges in the realm of cybersecurity. As we celebrate Cybersecurity Awareness Month, it's crucial to explore the implications of AI-powered voice imitation, commonly referred to as deepfake voice technology, and how it intersects with cybersecurity concerns.

The Rise of AI Voice Imitation Technology

AI voice imitation works by using machine learning algorithms to analyze audio recordings of a person speaking. By processing vocal characteristics—such as tone, pitch, rhythm, and speech patterns—AI systems can generate highly convincing audio that mimics a specific individual’s voice. Tools like Lyrebird, Descript, and Google’s WaveNet have shown how rapidly this technology is evolving. Once restricted to research labs, these tools are now available for commercial use, which opens the door to a wide range of applications—both legitimate and malicious.

While the potential of AI voice technology is undeniable, its darker applications are equally alarming. Cybercriminals are quick to leverage any new technology for malicious purposes, and AI voice imitation is no exception. One of the most concerning trends is the rise of "voice phishing" or "vishing" attacks. Unlike traditional phishing schemes, which involve fraudulent emails or messages, vishing uses AI-generated voices to trick victims into revealing sensitive information.

For instance, cybercriminals can impersonate a company executive or a trusted colleague to request wire transfers, confidential data, or login credentials. In one high-profile case, hackers used AI voice technology to impersonate the CEO of a UK-based company, tricking an employee into transferring over $240,000 to a fraudulent account. This is a clear example of how AI can amplify the risks businesses face in the modern threat landscape.

The Role of Cybersecurity in Combating AI-Driven Threats

In light of these threats, the role of cybersecurity becomes even more critical. As AI voice imitation technology continues to evolve, organizations must adopt proactive measures to safeguard against these types of attacks. Here are a few strategies businesses and individuals can use to protect themselves:

MFA is one of the most effective defenses against social engineering attacks. By requiring multiple forms of verification (e.g., a password and a mobile device code), MFA ensures that even if a hacker mimics a voice convincingly, they cannot easily gain access to sensitive systems or information.

2. Voice Verification and Authentication Solutions

Just as fingerprint and facial recognition are used for security, voice biometrics can help verify the identity of individuals before transactions or sensitive communications. While AI voice imitation can mimic many aspects of human speech, advanced voice recognition technologies can detect subtle variations that may go unnoticed by the human ear.

Cybersecurity Awareness Month serves as a timely reminder that human error remains one of the weakest links in any cybersecurity framework. Regular training sessions that focus on the evolving nature of AI-driven threats, such as vishing, can help employees recognize suspicious activity. Simulating potential attacks, including voice phishing attempts, can prepare staff to handle these situations in real time.

While AI can be a tool for hackers, it can also be a powerful ally for defenders. AI-driven cybersecurity solutions can detect anomalies in communication patterns or behavior, such as unusual requests for fund transfers or access to sensitive data. Implementing machine learning-based detection systems can help identify threats that may have bypassed traditional security protocols.

Governments and industry bodies must also play a role in regulating the use of AI voice technology. Cybersecurity laws and regulations should evolve to address these emerging threats, with clear guidelines on the ethical use of AI. For example, laws could mandate that all AI-generated voice communications be clearly labeled to prevent fraud and impersonation.

Cybersecurity Awareness Month emphasizes the importance of staying ahead of emerging threats, and AI voice imitation is a prime example of a rapidly evolving risk. The solution is not to fear new technology but to integrate robust security measures and foster a culture of vigilance within organizations.

Just as companies have become accustomed to scrutinizing email links for phishing attempts, the same level of caution must now be applied to voice communications. Employees should be trained to verify unusual or sensitive requests, even if they appear to come from a trusted source. Encouraging skepticism and double-checking communication—whether it be via a follow-up email, phone call, or face-to-face conversation—can prevent many AI-driven attacks.

AI voice imitation is a powerful tool that brings both opportunities and risks. For Cybersecurity Awareness Month, it’s essential to recognize the potential dangers of this technology while promoting best practices to combat AI-driven threats. As we continue to innovate, staying one step ahead of cybercriminals is key to ensuring a secure and resilient digital future.

By adopting strong authentication measures, leveraging advanced AI for threat detection, and fostering a culture of security awareness, businesses can safeguard themselves against the next wave of cyberattacks.

Learn how AI voice imitation technology poses new cybersecurity risks, including voice phishing attacks, and discover strategies to protect your organization during Cybersecurity Awareness Month.

The Interstellar Connection

Your Portal to Technology's Future

Cybersecurity Roundup: Major Breaches, Emerging Ransomware, and Critical Vulnerabilities

Stay updated on the latest cybersecurity threats, including a massive NYU data breach, the emergence of VanHelsing ransomware, a cyberattack on Ukraine’s railway, a critical Next.js vulnerability, and new security measures from Microsoft and Cloudflare.

Cyber Threat Report: Nation-State Espionage, Ransomware, and Emerging Cybercrime Trends

Stay updated on the latest cyber threats, including nation-state espionage, ransomware attacks, zero-day exploits, and data breaches. Learn how APT groups and cybercriminals are evolving their tactics.

Cisco Smart Licensing Flaws under Attack: Critical Vulnerabilities Leave Unpatched Systems Exposed

Critical vulnerabilities in Cisco Smart Licensing Utility (CVE-2024-20439, CVE-2024-20440) are under active attack, putting unpatched systems at risk. Learn how to protect your network now.

Hellcat Exploits Jira: Global Breaches and the Rising Supply Chain Threat

HellCat hackers are exploiting Atlassian Jira servers to breach global organizations, stealing sensitive data. Learn how they operate and how to protect your business."

Cyber Threats on the Rise: Record Crypto Heists, Ransomware Evolution, and State-Sponsored Espionage

Stay ahead of cyber threats with key insights on major breaches, ransomware, and emerging risks. Learn about the Bybit heist, GrubHub breach, new ransomware groups, and APT activity. Protect your business with expert analysis and security best practices.

Stellar Recognized on CRN's 2025 MSP 500 List for the Second Year in a Row

Stellar Awarded Pioneer 250 on CRN's MSP 500 List for 2025

The Top 5 Technology Trends to Watch in 2025

The Top 5 Technology Trends to Watch in 2025

AI Voice Imitation and Cybersecurity: A New Frontier for Cybersecurity Awareness Month

Learn how AI voice imitation technology poses new cybersecurity risks, including voice phishing attacks, and discover strategies to protect your organization during Cybersecurity Awareness Month.

Goodbye Passwords, Hello Passkeys!

The rise of passkeys to simplify security access.

Top Three Reasons to Use Desktop as a Service (DaaS)

Learn how Desktop as a Service (DaaS) offers a secure, reliable solution for anywhere, anytime access.

Learn More about What We Do