Author: Staff Writer

Summary Points A critical file-upload vulnerability (CVE-2021-26828) in OpenPLC ScadaBR allows remote attackers to upload and execute malicious JSP files, risking industrial control system disruption. The flaw, classified under CWE-434, enables authenticated users to bypass security controls, leading to persistent access and potential remote code execution. CISA mandates organizations to remediate this vulnerability by December 24, 2025, through vendor mitigations, network segmentation, and enhanced monitoring; immediate action is advised. While not yet linked to active ransomware, the vulnerability’s nature makes it highly attractive to threat actors, emphasizing the need for urgent patching and security reviews. What’s the Problem? A critical…

Top Highlights China-sponsored hackers have been persistently infiltrating U.S. organizations since at least 2022, using sophisticated malware called Brickstorm to access critical networks undetected for an average of 393 days. Brickstorm targets VMware vSphere and Windows systems to maintain long-term access, steal data, and facilitate lateral movement, mainly affecting government, IT, legal sectors, and edge devices. The campaign involves stealthy, evolving tools like Junction and GuestConduit, written in Golang, enabling extensive espionage through theft of configuration data, emails, and documents aligned with China’s interests. Despite limited understanding of their full scope, officials warn these attacks are highly active, exploiting poorly…

Fast Facts Phishing attacks increased by 400% year-over-year in 2025, making it the leading gateway for cyber threats like ransomware, which accounts for 35% of infections. Nearly 40% of recaptured stolen records contain business emails, indicating a heightened risk targeting corporate users, who are three times more likely to be phished than infected with malware. Cybercriminals leverage advanced, scalable phishing tools, including phishing-as-a-service kits, enabling even low-skilled actors to breach enterprise defenses at scale. Protecting organizations requires real-time visibility and post-compromise remediation of identity exposures across both personal and professional digital identities, beyond traditional defenses. Key Challenge In December 2025,…

Fast Facts ShadyPanda built trust over seven years by uploading legitimate extensions, then secretly weaponized them with malicious updates, infecting 4.3 million users. The campaign exploited the browser extension marketplace’s static review process, leveraging trusted updates to deploy persistent backdoors and malware. The malicious extensions functioned as flexible backdoors capable of surveillance, credential theft, or ransomware, with hourly remote code execution and obfuscated code evading detection. Similar infrastructure, code, and obfuscation methods linked multiple campaigns, revealing that marketplaces’ trust-based review models are exploited as an attack vector. Problem Explained Over the course of seven years, the threat group ShadyPanda meticulously…

Accelerated Government IT Modernization: Federal agencies are rapidly modernizing through AI, enhancing efficiency, citizen services, and national security, supported by the administration’s AI Action Plan. GSA OneGov Initiative Partnership: Palo Alto Networks secured a OneGov agreement with the GSA, simplifying access to AI-driven security solutions for federal agencies while integrating security into AI modernization efforts. Emerging AI Threats: Research highlights new cybersecurity risks, such as AI Agent Smuggling and Indirect Prompt Injection, emphasizing the need for robust AI security measures as AI ecosystems expand. Comprehensive Security Strategy: The collaboration provides federal agencies with a unified platform, Prisma AIRS, for securing…

Essential Insights Silver Fox is actively conducting a false flag campaign since November 2025, mimicking Chinese threat actors by using Cyrillic elements in malware to mislead attribution. The campaign employs SEO poisoning via Microsoft Teams to lure users into downloading a trojanized setup that deploys ValleyRAT, a remote access malware associated with Chinese cybercrime. The malware orchestrates intricate steps—scanning processes, disabling security tools, and establishing persistent backdoors—targeting Chinese-speaking users, including those in Western organizations operating in China. Silver Fox’s goals include financial theft and geopolitical intelligence gathering, operating covertly without explicit government ties, posing significant risks of data breaches, financial…

Fast Facts Phishing attacks have surged 400% year-over-year, now targeting nearly 40% of recaptured identity records, emphasizing the heightened threat to corporate users. Phishing is the primary entry point for ransomware, accounting for 35% of infections, with cybercriminals increasingly using automation and advanced tactics to breach enterprise defenses. Traditional security measures are insufficient; real-time visibility into compromised identities and proactive remediation are essential to prevent follow-on attacks. Over half of corporate users have experienced malware infections, often originating from personal devices, highlighting the need for comprehensive monitoring of both personal and professional digital identities. Key Challenge In December 2025, SpyCloud…

Fast Facts The Russia-linked Star Blizzard APT targeted Reporters Without Borders in March with phishing emails, using spoofed contacts and thematic lures like peace negotiations to facilitate attacks. They employed sophisticated techniques including compromised websites, inaccessible PDF files, and the use of a custom phishing kit designed to target ProtonMail accounts, specifically aiming to intercept two-factor authentication. The malware tools involve injected malicious JavaScript through an adversary-in-the-middle (AiTM) technique, which pre-fills login details and intercepts credentials via a modified ProtonMail sign-in page. Star Blizzard, active since 2019 and linked to Russia’s FSB in 2023, continues spear-phishing campaigns targeting NGOs, government…

Quick Takeaways In November 2025, 30 cybersecurity M&A deals were announced, involving key players like Arctic Wolf, Bugcrowd, and Palo Alto Networks, signaling significant industry consolidation and strategic expansion. Major acquisitions include Palo Alto Networks’ $3.35 billion purchase of Chronosphere, enhancing AI-driven observability, and SAFE’s acquisition of Balbix, focusing on continuous cyber risk management. Companies like Zscaler and SSL.com expanded their capabilities through acquisitions of AI security firm SPLX and VikingCloud’s digital certificate business, respectively, boosting security and compliance offerings. The month also saw numerous smaller deals across various cybersecurity sectors, reflecting ongoing industry diversification, technological innovation, and strategic positioning…

Essential Insights The Akhter brothers, former federal contractors, were charged with conspiring to steal and destroy sensitive government data after being rehired post-prison, highlighting serious security breaches. In February 2025, Muneeb Akhter allegedly deleted about 96 federal databases and sought AI assistance to cover his tracks, demonstrating malicious intent to disrupt government systems. Both brothers are accused of stealing personal and government information, including IRS data for 450 individuals, and attempting to obstruct investigations by destroying evidence and wiping devices. The case underscores how abuse of contractor roles can jeopardize national security and disrupt government services, emphasizing the need for…