Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that it is behind an attack on Red Hat, wherein it claims to have stolen private repositories from Red Hat’s GitLab.
Supply chain attacks have surged by 250% from 2021 to 2024, with third-party vendor compromise accounting for 45% of incidents. These attacks have a longer average dwell time (287 days) compared to direct attacks (207 days), indicating significant detection challenges. The financial impact is substantial, with supply chain attacks costing an average of $5.12 million per incident. CISA has issued an emergency directive emphasizing zero-trust architecture, Software Bill of Materials (SBOM) requirements, and continuous vendor risk assessments to mitigate these threats. European organizations face heightened risks due to their reliance on complex vendor ecosystems and critical infrastructure. Countries with dense technology sectors and critical infrastructure, such as Germany, France, and the UK, are particularly vulnerable. Mitigation requires tailored vendor risk management, adoption of SBOM tools, and enhanced monitoring of supply chain interactions. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation through trusted vendors, and broad scope, this threat is assessed as critical severity.
The FBI has taken down the BreachForums portal, a dark web platform used to facilitate extortion campaigns targeting Salesforce and potentially other organizations. BreachForums was known for hosting stolen data and enabling ransomware and extortion actors to communicate and distribute sensitive information. This takedown disrupts a key infrastructure used by cybercriminals for extortion and data breaches. Although no specific CVEs or exploits are mentioned, the threat involved real-world breaches and extortion attempts impacting organizations relying on Salesforce services. European organizations using Salesforce or related cloud services could have been targeted for data theft or extortion. The FBI's action reduces the immediate risk but highlights the ongoing threat of criminal forums facilitating ransomware and data breaches. Mitigation requires enhanced monitoring for extortion attempts, securing Salesforce environments, and incident response readiness. Countries with high Salesforce adoption and critical infrastructure reliant on cloud services are most at risk. Given the high impact on confidentiality and integrity, ease of exploitation via social engineering or credential compromise, and the broad scope of affected organizations, the severity is assessed as high.
There is a critical surge in AI-powered phishing campaigns, with a 300% year-over-year increase and a significant rise in attack sophistication. These campaigns leverage machine learning to analyze organizational communication patterns and employee behavior, generating highly personalized and contextually relevant phishing emails in real time. Traditional signature-based detection methods are largely ineffective against these dynamic, unique attack vectors. The FBI reports over 200 US organizations compromised within 30 days, and NIST predicts that by 2025, 90% of successful breaches will stem from AI-driven phishing. Although primarily targeting US infrastructure, European organizations are at risk due to the global nature of phishing and interconnected business relationships. Defenders must adopt advanced behavioral analytics, AI-driven detection, and comprehensive employee training to mitigate these threats effectively. Countries with significant digital infrastructure and high adoption of targeted sectors are most vulnerable. This threat is critical due to its high impact on confidentiality, integrity, and availability, ease of exploitation without user authentication, and broad attack surface.
AdaptixC2 is a lightweight, modular command-and-control framework designed for flexibility and customization. The analysis reveals its sophisticated capabilities, including multi-protocol communication, advanced evasion techniques, and a BOF execution system for extensibility. The discovery of 102 active servers across multiple countries indicates widespread operational use, with attackers leveraging legitimate cloud infrastructure. The framework's support for HTTP, SMB, and TCP protocols creates diverse attack vectors, while its dynamic API resolution and encryption techniques challenge traditional detection methods. Built-in operational security features and lateral movement capabilities demonstrate its effectiveness for long-term persistence and network penetration. The exposed infrastructure and configuration patterns provide valuable intelligence for proactive defense and threat hunting activities.
Hidden comments allowed full control over Copilot responses and leaked sensitive information and source code. The post GitHub Copilot Chat Flaw Leaked Data From Private Repositories appeared first on SecurityWeek .
The Crimson Collective hacker group has been reported targeting AWS cloud instances with the intent of stealing data. This threat involves unauthorized access to cloud environments, specifically those hosted on Amazon Web Services, aiming to exfiltrate sensitive information. Although detailed technical specifics and exploited vulnerabilities are not disclosed, the high severity rating indicates significant risk. European organizations using AWS cloud infrastructure are at risk of data breaches, potentially impacting confidentiality and operational integrity. The threat does not currently have known exploits in the wild, and minimal public discussion limits detailed understanding. Mitigation requires enhanced cloud security posture, including strict access controls, continuous monitoring, and incident response readiness. Countries with high AWS adoption and critical cloud-dependent sectors, such as the UK, Germany, France, and the Netherlands, are more likely to be affected. Given the potential for data theft without requiring user interaction, the threat severity is assessed as high. Defenders should prioritize securing AWS environments against unauthorized access and data exfiltration attempts.
A phishing campaign leverages Zoom's document sharing feature to establish initial trust with victims. The attack directs users through a fake bot protection page before presenting a Gmail-like login interface to harvest credentials. Entered credentials are transmitted to the attacker via WebSocket and validated on the backend. This technique exploits user trust in Zoom and mimics legitimate Gmail login to increase success rates. The campaign is currently observed with minimal discussion and no known widespread exploitation. It poses a medium risk due to credential compromise potential without requiring advanced exploitation or vulnerabilities. European organizations using Gmail and Zoom are at risk, especially those with remote workforces relying on these platforms. Attackers can gain unauthorized access to email accounts, leading to data breaches and further attacks. Mitigation requires user awareness, multi-factor authentication enforcement, and monitoring for suspicious login attempts. Countries with high Zoom and Gmail usage and significant remote work adoption are most likely affected.
Hackers accessed user accounts and compromised names, addresses, phone numbers, email addresses, and other information. The post DraftKings Warns Users of Credential Stuffing Attacks appeared first on SecurityWeek .
Salesforce has been targeted by widespread data theft attacks involving remote code execution (RCE) attempts. Despite the severity and scale of these breaches, Salesforce has publicly refused to pay ransom demands. The attacks indicate a significant compromise risk to customer data and internal systems, highlighting vulnerabilities in cloud service security. No specific affected versions or patches have been disclosed, and there are no known exploits in the wild yet. The threat is considered high severity due to the potential impact on confidentiality and integrity of sensitive data. European organizations relying on Salesforce services could face indirect impacts through data exposure or service disruption. Mitigation requires enhanced monitoring, strict access controls, and incident response readiness. Countries with high Salesforce adoption and critical cloud infrastructure are most at risk. The threat underscores the importance of robust cloud security practices and ransomware resilience strategies.
The Medusa ransomware operators exploited the GoAnywhere MFT vulnerability one week before patches were released. The post Fortra GoAnywhere MFT Zero-Day Exploited in Ransomware Attacks appeared first on SecurityWeek .
Wiz has teamed up with Microsoft, Google and AWS and is inviting cloud security researchers to its Zeroday.Cloud competition. The post $4.5 Million Offered in New Cloud Hacking Competition appeared first on SecurityWeek .
The Salesloft-Drift breach is a high-severity security incident involving unauthorized access to data from two prominent SaaS providers. Although detailed technical specifics are limited, the breach is considered one of the largest SaaS breaches reported in 2025, highlighting significant risks to customer data and service integrity. The breach was initially discussed on Reddit's NetSec community with minimal details but has been flagged as highly newsworthy. No known exploits are currently active in the wild, and no patches or affected software versions have been disclosed. European organizations using Salesloft or Drift services may face data confidentiality and operational risks. Mitigation requires enhanced monitoring of SaaS integrations, strict access controls, and verification of data integrity. Countries with high SaaS adoption and strategic reliance on these platforms, such as the UK, Germany, France, and the Netherlands, are most likely to be impacted. Given the breach's scale and potential data exposure without requiring user interaction or authentication bypass, the severity is assessed as high. Defenders should prioritize incident response readiness and vendor communication to manage potential fallout.
Ghost in the Cloud: Weaponizing AWS X-Ray for Command & Control
Source: https://securityaffairs.com/182968/hacking/ghost-in-the-cloud-weaponizing-aws-x-ray-for-command-control.html
Google Patches “Gemini Trifecta” Vulnerabilities in Gemini AI Suite That Could Steal User Data
Source: https://hackread.com/google-gemini-trifecta-vulnerabilities-gemini-ai/
A new campaign is distributing the Oyster (Broomstick) backdoor through trojanized Microsoft Teams installers. Threat actors are using SEO poisoning and malvertising to trick users into downloading fake installers from spoofed websites. The malicious installers deploy a persistent backdoor that enables remote access, gathers system information, and supports additional payload delivery while evading detection. This tactic mirrors earlier fake PuTTY campaigns, showing a trend of abusing trusted software for initial access. The backdoor communicates with attacker-controlled C2 domains and uses DLL sideloading via rundll32.exe for stealthy execution. Organizations are advised to download software only from verified sources and avoid relying on search engine advertisements.
