Threat actors exploited Cloudflare's free-tier infrastructure and Python environments to deploy AsyncRAT, demonstrating advanced evasion techniques. The attack begins with phishing emails containing Dropbox links to malicious files. It uses legitimate Python downloads and sophisticated code injection targeting explorer.exe. The campaign ensures persistence through multiple vectors, including startup folder scripts and WebDAV mounting. It abuses trusted infrastructure like Cloudflare to mask activities and evade detection. The attackers employ social engineering tactics, such as displaying legitimate PDF documents, to reduce suspicion. This campaign highlights the trend of abusing cloud services for malware delivery and execution, emphasizing the need for multi-layered security approaches.
In 2025, AI did not revolutionize cyber attacks as predicted. Instead, adversaries used AI to accelerate traditional tradecraft, focusing on speed and accessibility rather than new offensive capabilities. The article examines several case studies showcasing AI-generated scripts for credential theft and browser exploitation. These attacks, while faster and more accessible to less-skilled operators, still rely on familiar techniques detectable by basic security measures. The outlook for 2026 suggests continued AI-driven commoditization of tradecraft, with more templated attacks and improved phishing attempts. However, fundamental security practices remain effective against these evolving threats.
APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals. The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek .
Threat actors are hunting for misconfigured proxy servers to gain access to APIs for various LLMs. The post LLMs in Attacker Crosshairs, Warns Threat Intel Firm appeared first on SecurityWeek .
For the latest discoveries in cyber research for the week of 12th January, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manage My Health, New Zealand’s largest patient portal, has acknowledged a cyberattack occurred on December 2025, that potentially exposed data of nearly 110K users. An alleged attacker, dubbed Kazu, claimed responsibility and […] The post 12th January – Threat Intelligence Report appeared first on Check Point Research .
CVE-2025-69275 is a high-severity vulnerability in Broadcom DX NetOps Spectrum (version 24.3.9 and earlier) caused by a dependency on a vulnerable third-party component leading to DOM-based Cross-Site Scripting (XSS). The flaw allows an attacker to execute malicious scripts in the context of the affected application without requiring user interaction or authentication, though exploitation complexity is high. This vulnerability impacts confidentiality and integrity by potentially exposing sensitive data or enabling unauthorized actions within the management platform. European organizations using DX NetOps Spectrum for network monitoring and management are at risk, especially those in critical infrastructure sectors. No known exploits are currently in the wild, but the vulnerability’s presence in widely deployed network operations software necessitates prompt mitigation. Mitigation involves updating to a patched version once available, applying strict input validation and content security policies, and monitoring network traffic for suspicious activity. Countries with significant Broadcom DX NetOps Spectrum deployments and critical infrastructure reliance, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the CVSS 4.
CVE-2025-69273 is a high-severity improper authentication vulnerability affecting Broadcom DX NetOps Spectrum versions 24.3.10 and earlier on Windows and Linux platforms. This flaw allows an attacker with low privileges to bypass authentication controls without user interaction, potentially gaining unauthorized access to the network monitoring system. The vulnerability impacts confidentiality and integrity highly, with limited impact on availability. No known exploits are currently reported in the wild. European organizations relying on DX NetOps Spectrum for network management face risks of unauthorized access, data exposure, and manipulation of monitoring data. Mitigation requires prompt patching once available, strict access controls, network segmentation, and enhanced monitoring of authentication attempts. Countries with significant Broadcom customer bases and critical infrastructure sectors, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the ease of exploitation and critical nature of network monitoring systems, this vulnerability demands urgent attention from defenders.
CVE-2025-69268 is a medium-severity reflected Cross-site Scripting (XSS) vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The vulnerability requires no user interaction and can be exploited remotely over the network without authentication, but it demands low privileges on the system. While no known exploits are currently reported in the wild, successful exploitation could lead to session hijacking, unauthorized actions, or information disclosure within the affected management console. European organizations using DX NetOps Spectrum for network monitoring and management could face risks to confidentiality and integrity of their network operations data. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding on web interfaces, and restricting access to the management console via network segmentation and strong access controls. Countries with significant Broadcom enterprise deployments and critical infrastructure reliance on network monitoring, such as Germany, France, the UK, and the Netherlands, are most likely to be affected. Given the moderate CVSS score of 5.
CVE-2025-69267 is a high-severity path traversal vulnerability in Broadcom DX NetOps Spectrum versions 24.3.8 and earlier on Windows and Linux. It allows an attacker with low privileges to manipulate file paths to access restricted directories, potentially compromising confidentiality and integrity. Exploitation requires no user interaction but has high attack complexity. There are no known exploits in the wild yet, and no patches have been released. European organizations using DX NetOps Spectrum for network monitoring are at risk, especially in countries with significant Broadcom customer bases. Mitigation involves strict input validation, restricting file system permissions, and monitoring for suspicious path access attempts. Given the critical role of network management tools, exploitation could lead to significant operational disruption and data exposure. Countries like Germany, France, UK, and the Netherlands are likely most affected due to their large enterprise IT sectors and Broadcom product adoption.
UH officials refused to provide key information, including which cancer research project had been affected or how much UH paid the hackers to regain access to files. The post Hackers Accessed University of Hawaii Cancer Center Patient Data; They Weren’t Immediately Notified appeared first on SecurityWeek .
The Knownsec leak exposes a state-aligned Chinese cyber contractor deeply integrated with national security and intelligence operations. Internal documents reveal Knownsec's role in developing offensive cyber capabilities, large-scale reconnaissance systems, and data fusion platforms for public security bureaus and military clients. Key products include ZoomEye for global IP scanning, GhostX for exploitation, and Passive Radar for covert network mapping. The leak provides unprecedented insight into Knownsec's organizational structure, personnel, and strategic targeting of foreign critical infrastructure, particularly in Taiwan and other Asian countries. It demonstrates how commercial entities like Knownsec function as core components of China's cyber-espionage ecosystem, blending state objectives with industrial-scale development of intrusion and surveillance technologies.
Other noteworthy stories that might have slipped under the radar: Jaguar Land Rover sales crash, hundreds of gen-AI data policy violations, and Chinese cyberattacks against Taiwan intensified. The post In Other News: 8,000 Ransomware Attacks, China Hacked US Gov Emails, IDHS Breach Impacts 700k appeared first on SecurityWeek .
The North Korean state-sponsored espionage group Kimsuky has targeted government organizations, think tanks, and academic institutions. The post FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes appeared first on SecurityWeek .
Radware bypassed ChatGPT’s protections to exfiltrate user data and implant a persistent logic into the agent’s long-term memory. The post ‘ZombieAgent’ Attack Let Researchers Take Over ChatGPT appeared first on SecurityWeek .
Gulshan Management Services has informed authorities about a recent data breach resulting from a ransomware attack. The post 377,000 Impacted by Data Breach at Texas Gas Station Firm appeared first on SecurityWeek .
