The 15th September 2025 Threat Intelligence Report by Check Point Research highlights multiple significant cyber threats including ransomware attacks, data breaches, and critical vulnerabilities. Notably, Panama’s Ministry of Economy and Finance suffered a ransomware attack with theft of 1.5TB of sensitive fiscal data by the INC Ransom group. Other incidents include breaches impacting Vietnam’s financial sector, US organizations, and a British train operator via third-party compromise. Critical vulnerabilities such as a SonicWall SSL VPN improper access control flaw (CVSS 9.3) actively exploited by Akira ransomware operators pose severe risks. Emerging threats include new ransomware families like Yurei, supply chain attacks via malicious VS Code extensions, and malware targeting exposed Docker APIs. The report underscores a global surge in ransomware and targeted attacks on government, finance, manufacturing, and critical infrastructure sectors. European organizations face heightened risks due to interconnected supply chains, reliance on affected technologies, and geopolitical tensions. Proactive patching, supply chain security, and advanced threat detection are essential to mitigate these evolving threats.
For the latest discoveries in cyber research for the week of 8th September, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES A supply chain breach involving Salesloft’s Drift integration to Salesforce exposed sensitive customer data from multiple organizations, including Cloudflare, Zscaler, Palo Alto Networks, and Workiva. The attackers accessed Salesforce CRM systems via […] The post 8th September – Threat Intelligence Report appeared first on Check Point Research .
This report highlights the importance of community engagement in cybersecurity, reflecting on experiences at major conferences like Black Hat USA 2025 and DEF CON 33. It discusses the value of these events for professional development and networking but notes their high costs and limited accessibility. The author encourages seeking alternative, more accessible opportunities such as local conferences, student clubs, and online resources. The report also mentions recent cybersecurity news, including a rise in ransomware attacks in Japan and warnings about exploited vulnerabilities, emphasizing the evolving nature of cyber threats and the need for continuous education and vigilance.
This report discusses open-source intelligence (OSINT) related to disrupting active exploitation of vulnerabilities in on-premises SharePoint deployments. The threat involves multiple advanced persistent threat (APT) groups such as APT31, Emissary Panda, and Storm-2603, leveraging techniques including exploitation of public-facing applications, PowerShell execution, web shells, reflective code loading, and automated data collection. No specific CVE or technical details are provided, and no patch is currently available. The threat is assessed as high severity due to active exploitation and involvement of sophisticated threat actors.
Salt Typhoon is a Chinese state-sponsored threat actor targeting major telecommunications providers globally by exploiting vulnerabilities in various network devices. This analysis monitors exposures of internet-facing devices linked to Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction, while Cisco IOS XE exposure increased. Most exposures are concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices suggests ongoing challenges in remediation and organizational response.
The 'Game of Emperor' report details a persistent cyber intrusion campaign by the threat actor 'Earth Estries' targeting sectors such as consulting, managed service providers, NGOs, and telecoms. The campaign affects multiple countries primarily outside Europe, including Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. There are no known exploits or patches associated with this threat. The campaign is ongoing but assessed as medium severity due to its persistence and potential indirect risks to European organizations through global supply chains.
The report titled 'ACD - The Sixth Year' summarizes key findings from the sixth year of the UK National Cyber Security Centre's Active Cyber Defence (ACD) programme. The ACD programme, launched in 2017, aims to protect the majority of people in the UK from common cyber attacks through relatively automated defenses. This publication is a retrospective analysis and overview of the programme's effectiveness and activities rather than a specific vulnerability or exploit. No direct vulnerabilities, exploits, or affected software versions are identified in this report.
This report from the UK National Cyber Security Centre (NCSC) discusses the risks posed to UK industry and society by the proliferation of commercial cyber tools and services. It highlights concerns about how these tools, while commercially available, can be misused or contribute to broader cyber threats. The report does not specify particular vulnerabilities or exploits but provides an assessment of the threat landscape related to commercial cyber capabilities. No specific software versions or products are identified as affected. There are no known exploits in the wild linked to this report. The severity is assessed as medium based on the potential impact on UK industry and society.
This report assesses the cybersecurity threats posed to UK organisations by the use of Enterprise Connected Devices. It highlights potential vulnerabilities and risks associated with these devices within organisational environments. The threat is categorized as medium severity and does not reference specific affected versions or known exploits in the wild. No direct patch or remediation guidance is provided in the available data. The report aims to raise awareness and inform risk management decisions regarding connected device security in enterprises.
This entry describes key findings from the fifth year of the UK National Cyber Security Centre's Active Cyber Defence (ACD) programme, which aims to protect UK users from common cyber attacks through automated measures. It is not a specific vulnerability but rather a summary report of the programme's outcomes and activities. There are no specific affected versions, exploits, or technical vulnerabilities detailed. The report provides insights into the effectiveness of ACD efforts rather than describing a discrete security threat.
This report from NCSC UK outlines the security risks associated with the use of both official and third-party application stores on smartphones and smart devices. It highlights the complexity and variety of security issues that can expose consumers and enterprises to online threats through these platforms. The report serves to inform policy development aimed at improving app store security and privacy controls. No specific vulnerability or exploit details are provided, and no known exploits in the wild are reported. The report includes guidance links for mitigating general risks related to app store usage.
This entry describes a joint report by the UK National Cyber Security Centre (NCSC) and KPMG UK titled 'Decrypting Diversity: Diversity and Inclusion in Cyber Security Report 2020. ' The report benchmarks and tracks levels of diversity and inclusion within the cybersecurity industry, aiming to foster a more inclusive culture and address the industry's skills gap. It is not a security vulnerability or threat but an industry analysis and guidance document.
This document is a high-level technical paper from the UK National Cyber Security Centre (NCSC) describing the privacy and security design of the NHS COVID-19 contact tracing app. The app is intended to help slow the spread of coronavirus by supporting public health efforts. The paper outlines key privacy and security challenges and design decisions but does not detail the entire system or socio-technical aspects. The app was still in development at the time of the report, with plans for multiple releases and eventual open sourcing of the codebase. No specific vulnerabilities or exploits are described in this document.
The UK National Cyber Security Centre (NCSC) conducted an extensive security analysis of the UK telecommunications sector as part of the DCMS Supply Chain Review initiated in 2018. This analysis resulted in technical recommendations aimed at improving the security posture of the telecom sector, including formal advice on the use of High Risk Vendors (HRVs). The summary document outlines the technical security analysis underpinning these recommendations but does not specify individual vulnerabilities or exploits. No known exploits in the wild have been reported related to this analysis. The severity of the findings is assessed as medium.
