Surge in Cybercrime: Alarming Trends in Ransomware and Infostealer Attacks Recent research highlights a significant escalation in cybercrime activity throughout 2025, characterized by substantial increases across various types of threats. Notably, there has been a staggering 800% rise in credential theft attributed to information-stealing malware, defining identity theft as a…
July 20, 2025
Vulnerability / Threat Intelligence
A recently identified critical vulnerability in CrushFTP is now being actively exploited. Designated CVE-2025-54309, this flaw has a CVSS score of 9.0. According to the NIST National Vulnerability Database, “CrushFTP versions 10 prior to 10.8.5 and 11 prior to 11.3.4_23, when the DMZ proxy feature is not in use, improperly handles AS2 validation, enabling remote attackers to gain admin access via HTTPS.” CrushFTP reported detecting the first zero-day exploitation of this vulnerability on July 18, 2025, at 9 a.m. CST, although they noted that it might have been weaponized earlier. The company explained, “The attack vector utilized HTTP(S) to exploit the server. While we had addressed a separate AS2-related issue in HTTP(S), we did not realize that a previous bug could be exploited in this manner. It seems hackers observed our code changes and took advantage of them.”
Exploit of Critical Vulnerability in CrushFTP Grants Unauthorized Admin Access On July 20, 2025, cybersecurity experts reported that a serious security vulnerability in CrushFTP has been actively exploited. This vulnerability, identified as CVE-2025-54309, has been assigned a CVSS score of 9.0, indicating its critical nature. The vulnerability affects versions of…
July 20, 2025
Vulnerability / Threat Intelligence
A recently identified critical vulnerability in CrushFTP is now being actively exploited. Designated CVE-2025-54309, this flaw has a CVSS score of 9.0. According to the NIST National Vulnerability Database, “CrushFTP versions 10 prior to 10.8.5 and 11 prior to 11.3.4_23, when the DMZ proxy feature is not in use, improperly handles AS2 validation, enabling remote attackers to gain admin access via HTTPS.” CrushFTP reported detecting the first zero-day exploitation of this vulnerability on July 18, 2025, at 9 a.m. CST, although they noted that it might have been weaponized earlier. The company explained, “The attack vector utilized HTTP(S) to exploit the server. While we had addressed a separate AS2-related issue in HTTP(S), we did not realize that a previous bug could be exploited in this manner. It seems hackers observed our code changes and took advantage of them.”
Cybersecurity researchers have identified a new iteration of the ZLoader malware that utilizes Domain Name System (DNS) tunneling for command-and-control (C2) communications, showcasing that threat actors are actively enhancing their toolset after its reappearance a year ago. “Zloader version 2.9.4.0 features significant improvements, including a custom DNS tunnel protocol for C2 communications and an interactive shell supporting over a dozen commands, potentially aiding in ransomware attacks,” Zscaler ThreatLabz noted in a report released on Tuesday. “These enhancements provide added resilience against detection and mitigation efforts.” ZLoader, also known as Terdot, DELoader, or Silent Night, functions as a malware loader capable of deploying subsequent payloads. Following the shutdown of its infrastructure, malware campaigns distributing ZLoader were observed again for the first time in nearly two years in September 2023.
ZLoader Malware Resurfaces Utilizing DNS Tunneling for C2 Communications On December 11, 2024, cybersecurity experts reported the emergence of an updated version of the ZLoader malware, which now employs a Domain Name System (DNS) tunneling technique for its command-and-control (C2) communications. This advancement illustrates a continued evolution of this malicious…
Cybersecurity researchers have identified a new iteration of the ZLoader malware that utilizes Domain Name System (DNS) tunneling for command-and-control (C2) communications, showcasing that threat actors are actively enhancing their toolset after its reappearance a year ago. “Zloader version 2.9.4.0 features significant improvements, including a custom DNS tunnel protocol for C2 communications and an interactive shell supporting over a dozen commands, potentially aiding in ransomware attacks,” Zscaler ThreatLabz noted in a report released on Tuesday. “These enhancements provide added resilience against detection and mitigation efforts.” ZLoader, also known as Terdot, DELoader, or Silent Night, functions as a malware loader capable of deploying subsequent payloads. Following the shutdown of its infrastructure, malware campaigns distributing ZLoader were observed again for the first time in nearly two years in September 2023.
Researchers Expose Vulnerabilities in AI-Driven Calendar Systems In a recent study, cybersecurity researchers have revealed alarming vulnerabilities in AI systems, particularly those managing calendar invites. By integrating malicious prompts directly into calendar titles, these researchers demonstrated a series of sophisticated attacks that highlight significant gaps in existing security protocols. Though…
In a significant cybersecurity incident, researcher Jeremiah Fowler has revealed a critical data breach involving IMDataCenter, a Florida-based data solutions company. The breach has resulted in the exposure of a vast database that contains sensitive personal information belonging to individual users and various client organizations. The compromised database, which includes…
A federal judge has permitted a class-action lawsuit against Mr. Cooper, a prominent mortgage servicer currently being acquired by Rocket Companies, to proceed. The suit includes allegations of breach of contract and negligence stemming from a significant cyber attack in 2023 that compromised the personal information of nearly 14 million…
Severe Unpatched SharePoint Zero-Day Under Active Exploitation, Compromises Over 75 Company Servers
July 20, 2025
Zero-Day / Vulnerability
A serious security flaw in Microsoft SharePoint Server has been weaponized in an ongoing, large-scale exploitation campaign. The zero-day vulnerability, identified as CVE-2025-53770 (CVSS score: 9.8), is a variant of CVE-2025-49704 (CVSS score: 8.8), which was addressed by Microsoft in their July 2025 Patch Tuesday updates. Microsoft explained that “deserialization of untrusted data in on-premises Microsoft SharePoint Server enables unauthorized attackers to execute code over a network,” as detailed in an advisory released on July 19, 2025. The company is actively preparing a comprehensive update to mitigate this issue. Viettel Cyber Security is credited with discovering and reporting the flaw through Trend Micro’s Zero Day Initiative (ZDI). Additionally, Microsoft has acknowledged awareness of ongoing attacks related to this vulnerability.
Critical Unpatched SharePoint Zero-Day Under Active Exploitation, Compromises Over 75 Company Servers July 20, 2025 In an alarming development, a critical zero-day vulnerability in Microsoft SharePoint Server has been actively exploited in a large-scale attack campaign, leading to the breach of more than 75 company servers. This vulnerability, designated as…
Severe Unpatched SharePoint Zero-Day Under Active Exploitation, Compromises Over 75 Company Servers
July 20, 2025
Zero-Day / Vulnerability
A serious security flaw in Microsoft SharePoint Server has been weaponized in an ongoing, large-scale exploitation campaign. The zero-day vulnerability, identified as CVE-2025-53770 (CVSS score: 9.8), is a variant of CVE-2025-49704 (CVSS score: 8.8), which was addressed by Microsoft in their July 2025 Patch Tuesday updates. Microsoft explained that “deserialization of untrusted data in on-premises Microsoft SharePoint Server enables unauthorized attackers to execute code over a network,” as detailed in an advisory released on July 19, 2025. The company is actively preparing a comprehensive update to mitigate this issue. Viettel Cyber Security is credited with discovering and reporting the flaw through Trend Micro’s Zero Day Initiative (ZDI). Additionally, Microsoft has acknowledged awareness of ongoing attacks related to this vulnerability.
Dec 16, 2024
Cyber Attacks / Cyber Espionage
The Security Service of Ukraine (SBU) has uncovered a new espionage initiative allegedly led by Russia’s Federal Security Service (FSB), involving the recruitment of Ukrainian minors for illicit activities disguised as “quest games.” Law enforcement officials detained two groups of FSB agents in a special operation in Kharkiv, which included only children aged 15 and 16. According to the SBU, “The minors undertook hostile missions involving reconnaissance, targeting adjustments, and arson.” To obscure their subversive roles, both factions operated independently. Under the FSB’s quest game framework, the children were provided with geographic coordinates and tasked with reaching specified locations, capturing photos and videos of targets, and offering a description of the surrounding environment. The findings from these reconnaissance missions…
Ukrainian Minors Targeted for Espionage Activities Linked to Russian Cyber Operations December 16, 2024 Cyber Attack / Cyber Espionage In a troubling development in the realm of cybersecurity, the Security Service of Ukraine (SBU) has unveiled a sophisticated espionage campaign believed to be directed by Russia’s Federal Security Service (FSB).…
Dec 16, 2024
Cyber Attacks / Cyber Espionage
The Security Service of Ukraine (SBU) has uncovered a new espionage initiative allegedly led by Russia’s Federal Security Service (FSB), involving the recruitment of Ukrainian minors for illicit activities disguised as “quest games.” Law enforcement officials detained two groups of FSB agents in a special operation in Kharkiv, which included only children aged 15 and 16. According to the SBU, “The minors undertook hostile missions involving reconnaissance, targeting adjustments, and arson.” To obscure their subversive roles, both factions operated independently. Under the FSB’s quest game framework, the children were provided with geographic coordinates and tasked with reaching specified locations, capturing photos and videos of targets, and offering a description of the surrounding environment. The findings from these reconnaissance missions…
KLM Airlines Reports Data Breach Affecting Customer Information KLM Airlines, officially known as KLM Royal Dutch Airlines and a key player in the French-Dutch aviation sector, has informed its customers about a recent data breach that compromised certain personal information. The breach occurred due to unauthorized access to a third-party…
