If the attackers don’t break the rules, what would happen if they just follow them better than us? When the system works exactly as if it is built, but its “designed” behavior quietly opens the door to risk?
This week brings you a story that will stop and rethink what you really are in control. It’s not always a broken firewall or patch. It’s about small choices, default settings, and shortcuts that feel harmless until they don’t.
A real surprise? Threats may not come from outside. It’s quickly burned into how things are set. We dive in to see what’s quietly shaping today’s security challenges.
⚡This week’s threat
The FBI warns that spiders will be scattered on airlines – The US Federal Bureau of Investigation (FBI) has warned of new attacks scattered with spiders scattered by infamous cybercriminal groups targeting the airline sector, using sophisticated social engineering techniques to gain early access. Cybersecurity vendors Palo Alto Networks Unit 42 and Google Mandiant will also issue similar alerts, encouraging organizations to apply the necessary mitigations to enforce strong authentication, identity separation and strict identity control for password resets, and will enhance multifactor authentication (MFA) registration.
🔔Top News
- LAPDOGS ORB network compromised over 1,000 SOHO devices – China-linked APT has built an operational relay box (ORB) network called LapDogs, consisting of over 1,000 backdrawtors for the purposes of espionage. Digital Break-In started by September 2023 and has since expanded. The campaign is primarily targeted at end-of-life routers, IoT devices, Internet-connected security cameras, virtual servers, and other small office/home office (SOHO) devices, and is intended to build operational relay box (ORB) networks. Five geographical regions – the United States (352 casualties), Japan (256 casualties), South Korea (226 casualties), Taiwan (80 casualties), and Hong Kong (37 casualties) – make up about 90% of the total orb network. The attack takes advantage of known security flaws on Linux-based devices and drops a backdoor called ShortLeash. The purpose of the malware itself is unknown, but it has been found to share similarities with another malware sample used by UAT-5918. As part of systematic and small efforts around the world to gain long-term access to the network, devices are suspected to be gradually, but steadily compromised.
- Iranian hacking groups target Israeli cybersecurity experts – APT35, a state-sponsored hacking group related to the Islamic Revolutionary Guard (IRGC), is linked to a spear phishing campaign targeting journalists, well-known cybersecurity experts and Israeli computer science professors, and is about to redirect them to a voice phishing page where you can collect Google accounts. Attacks that take place in emails and WhatsApp messages use fake Gmail login pages or Google invitations to collect qualifications. This development comes amidst geopolitical tensions between Iran and Israel, leading to a surge in hackitivist activities in the region. “There are around 170 hacker groups attacking Israel, there are around 1,345 cyberattacks against Israel, including around 447 cyberattacks launched against Israel after the conflict broke out,” NSFocus said in a report released last week. “The number of hacker groups attacking Iran has reached around 55, and the number of cyberattacks against Iran reaches around 155, of which around 20 have been launched against Iran after the conflict broke out.”
- Citrix patches actively used 0 days – Citrix has released a security update to address critical flaws affecting Netscaler ADCs that are said to have been exploited in the wild. The vulnerability tracked as CVE-2025-6543 (CVSS score: 9.2) is a memory overflow bug that can result in unintended control flows and denial of service. It is not clear how vulnerabilities are being exploited in the wild at present. The exploitation of CVE-2025-6543 is consistent with reports that another critical security vulnerability in Netscaler ADC (CVE-2025-5777, CVSS score: 9.3) has also been weaponized in actual attacks after public disclosure.
- US Homes Prohibit WhatsApp Use on Government Devices – The US House of Representatives has formally banned Congress staff members from using WhatsApp on government-issued devices, citing security concerns. According to the House Secretary (CAO), the decision was based on the way WhatsApp protects user data, the lack of data encryption at rest, and the lack of transparency in potential security risks. WhatsApp rejects these concerns, saying that messages are end-to-end encrypted by default, providing a “higher level of security” than other apps.
- New tools to neutralize encrypted botnets – Akamai proposed a new mechanism to use the Defang Cryptomining botnet using Xmrogue. This is a proof-of-concept (POC) tool that allows defenders to stop using endpoints that have compromised mining proxy servers for illegal mining. If no mining proxy is used, the approach uses a script to send over 1,000 concurrent login requests using the attacker’s wallet. That being said, it is worth noting that these methods are a way to disable mining infrastructure, and therefore do not necessarily remove malicious code from the system.
Pean Trend CVE
Hackers jump quickly to a newly discovered software flaw. Whether you missed an update or a hidden bug, even one unpatched CVE can open the door to serious damage. Below is how to create a wave of high-risk vulnerabilities this week. Check the list, patch quickly, and go one step ahead.
This week’s list includes CVE-2025-49825 (Teleport), CVE-2025-6218 (Winrar), CVE-2025-49144 (Notepad++), CVE-2025-27387 (Oppo Coloros), CVE-2025-2171, CVE-2025-2172 (CVE-2025-52562 (Convoypanel), CVE-2025-27915 (Zimbra Classic Web Client), CVE-2025-48703 (CENTOS Web Panel), CVE-2025-23264, and CVE-2025-23265 (NVIDIA) MEGATRON LM), CVE-202537) CVE-2025-4563 (Kubernetes), CVE-2025-2135 (Kibana), CVE-2025-3509 (Github), CVE-2025-36004 (IBM I), CVE-2025-49853 (ControlID Idsure), CVE-2025-37101 CVE-2025-3699 (Mitsubishi Electric), CVE-2025-6709 (MongoDB), CVE-2025-1533, CVE-2025-3464 (Asus Armory Crate), and Kerio Unearned flaws affecting Control.
Cyber Around the world of cyber
- Security flaws affect hundreds of printers and scanners – Eight security vulnerabilities have been disclosed in Brother Industries, Ltd’s Multifunction Printers (MFPs), affecting 742 models from four vendors, including Fujifilm Business Innovation, Ricoh, Toshiba Tec Corporation and Konica Minolta. “Some or all of these vulnerabilities have been identified as affecting 689 models across the range of devices from their sibling printers, scanners and label makers,” Rapid7 said. “In addition, Fujifilm Business Innovation’s 46 printer models, Ricoh’s five printer models, and Toshiba Tec Corporation’s two printer models are affected by some or all of these vulnerabilities.” The most serious of the flaws is CVE-2024-51978 (CVSS score: 9.8). This is an important bug that allows remote unauthenticated attackers to leak the serial number of the target device by chaining it with CVE-2024-51977 (CVSS score: 5.3) and generate the admin password for the target device. Administrator passwords allow an attacker to reconfigure a device or abuse feature for authenticated users.
- French police reportedly arrested the violation administrator. – French authorities have arrested five high-ranking members of Breachforums, an infamous online hub that specializes in selling stolen data and cybercrime tools. This included forum users Shiny Hunters, Hollow, Noct and Decression. The fifth suspect was allegedly arrested by a French police officer in February 2025. He was gone by Intelbroker (aka Kyle Northern), who is now identified as a 25-year-old British man named Kai West. The latest iteration of the violation form is currently offline. West’s real-world identity was made public after an undercover federal agency (FBI) agent purchased a stolen API key, granted one victim’s illegal access to the website, and tracked the address of his Bitcoin wallet, according to the US Department of Justice (DOJ). West is charged with conspiracy to break into a computer, conspiracy to commit wire fraud and conspiracy to access and retrieve information on a protected computer. In total, he faces up to 50 years of prison. “A suspected serial hacker Kai West has been charged for a negative long-standing scheme to steal victims’ data and sell them to millions with illegal funds, causing more than $25 million in damages worldwide,” the US is seeking extradition.
- Canada orders hikvision to close Canadian businesses – The Canadian government has ordered China’s CCTV systems vendor Hikvision to suspend all operations within the country and shut down Canadian businesses following a national security review. “The government has determined that the ongoing operation of the Hikvision Canada IC in Canada is harmful to Canada’s national security,” according to a statement released by Canadian Minister of Industry Mélanie Joly. “This decision is the result of a multi-step review that assessed the information and evidence provided by the Canadian security and intelligence community.” Furthermore, the order prohibits the purchase or use of Hikvision products in government departments, agencies and crown companies. Hikvision called the allegations “no basis” and called the decision “no factual basis, no procedural fairness or transparency.”
- Details of NCSC in the UK “Authentic Antis” Malware – National Cyber Security Center (NCSC) focuses on real malware running within the Microsoft Outlook process. “Stolen credentials and token data are extracted by using the newly stolen tokens, authenticating victim prospects for web accounts via the Outlook Web API and sending emails to actor-controlled email addresses,” the NCSC said. “Emails will not appear in the victim’s send folder.”
- Microsoft wants to avoid a stop like another cloud strike – Microsoft said it plans to offer a private preview of the Windows Endpoint security platform to select Endpoint security partners, including BitDefender, Crowdstrike, ESET, Sentinelone, Trellix, Trend Micro, and Secure. “This means that security products like antivirus and endpoint protection solutions can run in user mode, just like apps do,” Microsoft said. “This change will help security developers to have a higher level of reliability and recovery, and will reduce the impact on Windows devices in the event of unexpected issues.” First announced in November 2024, the change is due to a false cloud strike update in nearly a year that has deprecated 8.5 million Windows-based machines worldwide. In tandem, Microsoft also said it gave Blue Death (BSOD) a major visual transformation, nearly 40 years after its Windows debut, blackened and listed the stop code and failed system drivers behind the crash to make it more clear.
- Noyb accuses Bumble of violating the EU GDPR – Bumble and Bumble for Friends For Friends Feature are in violation of European general data protection regulations, according to a complaint from Austrian privacy nonprofit Noyb. “The feature with Openai’s ChatGpt is designed to help you start a conversation by providing AI-generated messages,” Noyb said. “To do this, your personal profile information is fed to the AI system without your consent. The company repeatedly shows a banner designed to click “OK” to suggest that it depends on the user’s consent, but in fact it claims that it has so-called “legitimate interests” to use the data. Noyb said the “OK” option gives users a false sense of control over the data when they claim that they have a legitimate interest in sending user data to OpenAI.
- Jitter trap turns evasion into detection – Cybersecurity researchers have designed a clever new technique called Jitter-Trap, which aims to detect command and control (C2) communications after explosion due to the use of red teaming frameworks such as Cobalt Strike, Sliver, Empire, Myth, and Havoc. Evasion detection. These tools are known to use a parameter called “sleep” that defines how often a beacon communicates with an operator (i.e. a C2 server). One obfuscation method used to cover up this periodic beacon activity action is “jitter”, which adds a bit of randomness to the communication pattern and prevents it from being detected. “The jitter property of sleep time between requests exists to make it look natural and create a light randomness intended to look like the actual traffic that the user causes,” says Varonis. Jitter-Trap shows how Dafender leverages patterns of randomness to determine whether such traffic exists in the first place, and effectively alters the attacker’s own tactics.
- Revil members released in Russia – Four members of the Revil Ransomware Group, Andrey Bessonov, Mikhail Golovachuk, Roman Muromsky and Dmitry Korotayev, were convicted in Russia of financial fraud and cyber crimes and sentenced to five years in prison, but after the court served as a resignation sentence, the court was eventually released after being finally released. This will take less than three years to detention. It is worth noting that they were arrested in early 2022, using malicious software to commit fraud using stolen payment data and malicious software. Other members of the crew, Danil Puzailevsky, Ruslan Kanvialov, Alexy Marozemov and Artem Zayetz, were jailed for four and a half years to six years in October 2024. Last year, he was sentenced to almost 14 years in May 2024, and was ordered to return $16 million to various victims. It is rare for Russia to indict its own hackers. In April 2022, Russia said the US had unilaterally shut down its communication channels with Russia over cybersecurity and retracted the negotiation process on the Revil gang.
- Malicious Python package shuts down Windows systems – A malicious Python package named PSSLIB has been detected in Python Package Index (PYPI) repository, which disguises itself as a password security utility since November 2018, quietly attracting over 3,700 downloads to date. This package is a valid Passlib library type skirt and can shut down your Windows system immediately if the user enters a password that does not match the value set by the package’s developer. The library also includes a built-in feature to invoke a system restart without warning or consent. This discovery is because two “protestware” packages with Hidden functionality are flagged in the NPM registry. Packages (@link-loom/ui-sdk and @link-loom-reacsdk) specifically target Russian users who visit Russian or Belarusian domains (.ru, .su, and .by), block mouse-based interactions on web pages, and play Ukrainian anmem in loops infinitely. That said, this attack ensures that only visitors to the site repeat themselves. This means that it is triggered only if the target visits the website multiple times.
- Tudou Guarantee leads after Huione closure – Following the closure of the Fuione warranty last month, the illegal telegram market, known as the Tudou warranty, emerged as the main winner. The latest findings show that it is a normal business for the Chinese black market in the wake of two biggest Tekedowns in these bazaars: Huione and Xinbi guarantees. Both services are estimated to have enabled a staggering $35 billion in transactions. Blockchain intelligence company Elliptic said it is tracking over 30 very aggressive guarantee markets. “Most notable is that the Tudou guarantee has seen users more than twice as many users, and the influx of cryptocurrency is roughly equivalent to what you would see in the Huione guarantee before closing,” the company said. “Many of the merchants operating in Tudou are the same as those previously sold through Huione Guarantee, offering stolen data, money laundering services, and other products that scammers need.” This shift is important in light of the fact that Huione Guarantee is a major shareholder in Tudou Guarantee. These con artists have caused misery to millions of victims around the world and have stole billions of dollars. Unless these markets are actively pursued, they will continue to thrive.”
- South Korea targeted by Meshagent and Supershell – Korean Windows and Linux servers are targeted by Chinese-speaking threat actors, dropping web shells such as SuperShell and remote desktop software such as Meshagent to establish permanent access and install additional payloads. We found that the IP address used for the payload stage includes Wograt (short for “Wingsofgod”), a backdoor that can collect system information and execute any commands issued by the remote server. According to Ahnlab, the exact initial access vector used in the attack is unknown. “Attackers seem to target Linux as well as windows, and try to control the network they belong to by moving infected systems from the initial intrusion stage to the lateral movement stage,” the cybersecurity company said. “The ultimate goal is unknown, but attackers can infect the network with ransomware if they steal sensitive information or if they successfully control the organization’s network.”
- Androxgh0st Malware evolves to add new flaws – It turns out that the threat actors behind Androxgh0st malware are leveraging compromised websites related to the University of California, San Diego and an unknown Jamaican event aggregator platform for C2 purposes. Attacks mounted by Python-based cloud attack tools are known to exploit a wide range of known security flaws, including those affecting Apache Struts, Apache Shiro, FasterXML, Lantronix Premierwave, Popup Maker WordPress plugins, and spring frameworks. “Botnets exploit popular platforms (Apache Shiro, Spring Framework, WordPress) and IoT devices (Lantronix) to enable remote code execution, theft of sensitive data, and encryption,” CloudSek said.
- Fishing campaigns utilize cap cut lures – The new fading campaign uses fake Capcut Invoice Lure to defeat recipients to mimic the login page of your Apple account and click on fake links that prompt you to enter your financial information to get a refund. However, this attack is designed to secretly hoover your eligibility and credit card details to an external server. “As Capcut continues to dominate the short video editing scene, cybercriminals are seizing an opportunity to capitalize on its popularity,” Cofense said.
- Dutch police contact 126 people in connection with Cracked.io – Dutch police have identified and contacted 126 individuals who had accounts on the Cracked.io hacking forum. Authorities filed criminal cases against the eight suspects and warned the remaining individuals to engage in further criminal activities. The youngest person to be contacted by the authorities was 11 years old. US and European law enforcement caught a crack this early this January and ignored it. Before Takedown, the forum had over 4.7 million users, known for its hacking services, stolen data and malware sales.
- Airoha Socs vulnerability – Cybersecurity researchers have discovered three flaws in devices that incorporate the Airoha system into chips (SOCs) that can be weaponized to take over sensitive products without the need for authentication or pairing. “If the attacker is within Bluetooth range, vulnerable devices can be compromised,” the researchers said. The vulnerabilities assigned the CVE identifiers CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702 are related to missing authentication for the GATT service, missing authentication for Bluetooth BR/EDR, and unrecognized vulnerabilities in custom protocols for operating the device. According to cybersecurity company ERNW, Bluetooth chipsets are used in headsets, earphones, dongles, speakers and wireless microphones. “Some vendors are not aware that they are using Airoha SoCs,” Ernw said. “We outsource some of the device development, such as Bluetooth modules.”
- Operation Overload uses API to amplify Pro-Russian propaganda – Russian disinformation manipulation, known as Operation Overlord, employs artificial intelligence (AI) to generate Russian propaganda, spreading it to Telegram, X, Bluesky, and Tiktok. This activity often impersonated journalists, public figures and respected institutions, and often edited content, in order to hamper political discourse in Ukraine, France, Germany, Poland, Moldova and the United States. “An anti-Frenian narrative continues to dominate, but election interference stands out as a prominent theme,” Ceks First said.
- Crypto Drainer Scam impersonates a tax authorities – It has been observed that a new phishing campaign called Declaration Trap targets cryptocurrency users, impersonating European tax authorities, especially Dutch institutions, as belastingdienst and mijnoverheid. In these attacks, future victims are led through email messages to phishing sites that harvest personal information and suck up the phishing kit of encrypted drainage equipment to perform chiffon seed phrases, and perform malicious withdrawals by sending malicious transaction signature requests. “The victim’s journey begins with an email that appears to have come from Belasting Dienst or Mijnoverheid, and tells the recipient that a special declaration form for crypto assets must be completed for the new tax rules introduced in 2025,” Group-IB said. “Cheaters use pressure tactics. They set short deadlines to complete the form, and if they fail to comply, they threaten the victim with a fine.” IBM X-Force details phishing campaigns in which Waveronized Scalable Vector Graphics (SVG) files target financial institutions around the world to embed JavaScript to steal credentials and drop Remote Access Trojans (RATs). “When executed, JavaScript with SVG embedded will drop a ZIP archive containing the JavaScript files that are used to download Java-based loaders,” IBM said. “If Java is present, deploy modular malware such as Blue Banana Rat, Sambaspy, and SessionBot.”
- HIVE0131 Campaign Offers DCRAT in Colombia – In a new phishing campaign detected in early May 2025, the threat actor launched an attack chain that targeted fake users in Colombia, targeting fake users on criminal cases, and ultimately provided modular DCRAT malware to harvest file, keystrokes, audio and video recordings. “HIVE0131 is a financially motivated group that likely gave birth to South America, and will run campaigns primarily in Latin America (LATAM) to provide a wide range of product payloads,” IBM X-Force said. “The current campaign mimics its official response, and includes a PDF lure with an embedded link or embedded link. Clicking on the embedded link will launch an infection chain and run the bank trojan “DCRAT” into memory. “Attacks involving an embedded link to a PDF lure with a link to Tinyurl or Google Docs location is characterized by the use of the obfuscated .NET loader vmdeTectoloader, which is used to download and run DCRAT. (Updated: The same campaign has also been documented by Fortinet, evading detection by detailing the use of password-protected archives, obfuscation, steganography, Base64-Encoding, and multiple file drop threat actors.)
- CISA and NSA are seeking to adopt memory-safe languages – The US Cybersecurity and Infrastructure Security Agency, together with the National Security Agency (NSA), has issued guidance on the adoption of memory safety languages (MSLs), such as Rust, to mitigate memory-related vulnerabilities in software. MSLS provides built-in mechanisms such as limit checking, memory management, data race prevention, and runtime safety checks to protect against memory bugs. “Achieving better memory security requires language-level protection, library support, robust tools and developer training,” the institution said. “MSLS provides built-in protection guards that shift the burden of safety from developers to languages and development environments. By directly integrating safety mechanisms at the language level, MSLS enhances security outcomes and reduces reliance on post hoc analytics tools.” However, the report also points to the challenges of legacy systems and the adoption of mass-raises and the tightly coupled code, performance overhead, and the availability (or lack of) the tools and libraries available in MSL.
- New SmartAttack technique uses SmartWatches to steal air gapped data – A new side-channel attack called SmartAttack has demonstrated the use of smartwatches as receivers for ultrasound hidden communication in air-rated environments. This approach utilizes the built-in microphone of the smartwatch to capture the cover signal in real time within the ultrasound frequency range of 18-22 kHz, according to Dr. Mordekigli, head of the offensive cyber research lab at the School of Software Information Systems Engineering at Ben Gurion University in Israel. Like other attacks of this type, the threat model assumes that an attacker has already penetrated the air suppression system, embedded secretly working malware, and used the speakers of an infected machine to send information over a range of frequencies that humans cannot hear. On the other hand, attacks require threat actors to compromise on personal smartwatches that have access to a secure environment, to receive secret ultrasound communications, to decrypt, rebuild, and deploy malware that can be forwarded to the attacker’s infrastructure. In an experimental setup, data can be transmitted via ultrasound signals over a distance of 6 meters or more, with data rates up to 50 bits per second. Dr. Gri, who last year disclosed the Rambo and pixel attacks to remove data from air-gap systems, said the findings underscore “the security risks posed by smartwatches in security environments.” Possible mitigations include banning smartwatches and similar audio-enabled wearables when entering a safe environment, identifying unauthorized transmissions of ultrasound surveillance systems, deploying ultrasound jammas, and physically removing or disabling audio hardware components.
- Google adds new security features to tackle XSS attacks – Google uses the HTML attribute to specify the “”A new security feature has been added to the Chrome browser, which automatically escapes characters. The new feature is designed to prevent cross-site scripting attacks that rely on slipping malicious code in HTML code. This feature was shipped to a stable version of Chrome 138, released on June 24, 2025. “There may be a DOM tree that is considered safe for sanitizers. However, after re-rated, this DOM tree is virtually different and becomes XSS.” This type of XSS attack is called mutant XSS (MXSS).
🎥Cybersecurity Webinar
- Identity Design for Trust in Scale – With Privacy, AI and Seamless Login in In mind ➝ In today’s AI-powered world, customer identity is all about trust. This webinar unlocks insights from the Auth0 2025 Trends report. This covers how users react to AI, growing privacy expectations, and the latest identity threats. Whether you’re building a login flow or a trust strategy, you’ll get clear and practical advice.
- Stop installing and praying pip: Securing the Python supply chain in 2025 ➝ The 2025 Python ecosystem is under attack from repository jacks and type skates to hidden flaws in common container images. If you still have “installation and hopes of pips,” it’s time to reconsider. Security experts unlock real threats, explain tools like CVE, Sigstore, SLSA, and share how Pypi responds. Whether you’re using the Yolo model or using Managing Production Apps, you’ll get clear and practical steps to protect today’s Python supply chain.
🔧Cybersecurity Tools
- lift ➝ Microsoft has an open source lift, a tool that helps analysts find code written by attackers in complex Rust malware. As rust-rising actors become more popular among threatening actors, malware becomes more difficult to analyze. Rift uses automatic signature matching and binary defense to reduce noise by highlighting only custom code, saving time and improving detection.
Disclaimer: These newly released tools are for educational use only and have not been fully audited. Use at your own risk – refer to the code, test it safely, and apply appropriate protection measures.
🔒Tip of the Week
Beyond Default: Mastering Windows Hardening The default Windows settings are easy to build, not security. It’s fine for casual use, but if you’re concerned about protecting only your data, business, or privacy, go beyond the basics.
Good news? You don’t need to be sysadmin to lock down your system. Tools like HardeningKitty, CIS-CAT Lite, and Microsoft’s Security Compliance Tool Kit will do heavy lifting for you. They scan your system to tell you exactly what to fix, such as disabling old protocols (SMBV1, NetBIOS), hardening office macros, turning off high-risk Windows features you don’t use.
If that sounds a little, don’t worry. There is also a one-click app. configuredefender lets you take full advantage of Microsoft Defender protection (including turning on advanced hidden rules). WPD and O&O Shutup10++ help you cut Windows tracking, bloatware and junk settings in minutes. Think of them as “Privacy + Security” as a switch that Microsoft should be offering by default.
Do you want to be serious? Starting with CIS-CAT Lite, check where the system is standing, close GAPS and run HardeningKitty. These cut out actual attack paths, not just checkboxes, but also phishing payloads, document-based malware, and lateral movements across the network.
Conclusion: There’s no need to “just use Windows as is.” Instead of opposing you, you can make it work for you without breaking anything. Small changes, big impact.
Conclusion
It’s easy to get caught up in technical details, but at the end of the day, it’s about making wise decisions with the tools and time we have. No one can fix everything at once, but knowing where the crack is half the battle. Whether it’s a quick configuration check or a deeper policy rethink, the small steps are summed.
Take a few minutes and scan the highlights to see where your team needs a second look.
