Author: Staff Writer

Summary Points Ransomware attacks surged by 389% in 2025, with confirmed victims rising to 7,831 globally, driven by AI-powered tools making sophisticated attacks accessible to all. The use of dark web marketplaces for crime tools like WormGPT and FraudGPT has democratized hacking, enabling even low-level criminals to execute targeted and frequent ransomware campaigns. The attack lifecycle cycle has shortened dramatically, with the time-to-exploit dropping from nearly 5 days to just 24-48 hours, exemplified by rapid exploitation post-vulnerability disclosures. Credential-stealer malware dominates dark web datasets (67%), with RedLine, Lumma, and Vidar responsible for the majority of infections, significantly increasing the speed…

Summary Points Malicious Ruby gems and Go modules disguised as legitimate libraries are used to automate credential theft, GitHub Actions tampering, and establish SSH persistence. Attackers exfiltrate sensitive data like environment variables, SSH keys, and cloud credentials, while modules manipulate CI workflows and deploy fake binaries for ongoing access. Threat actors leverage these supply chain compromises to infiltrate developer environments, steal data, and maintain persistent, covert access to targeted systems. Threat, Attack Techniques, and Targets This recent campaign involves malicious packages disguised as legitimate Ruby gems and Go modules. The attacker used the GitHub account “BufferZoneCorp” to publish these packages.…

Essential Insights AI-driven tools like WormGPT and FraudGPT enable sophisticated, large-scale phishing, social engineering, and malicious code generation at unprecedented speeds. The window for exploiting newly disclosed vulnerabilities has shrunk to under 48 hours, with some attacks occurring within hours of public disclosure. Ransomware remains highly profitable, with organized cybercrime ecosystems now leveraging automation and AI to streamline attacks and maximize financial gains. The Threat, Attack Techniques, and Targets Cybercriminals now use artificial intelligence (AI) to boost their illegal activities. They have created an “industrialized” system, which works like a business. Criminal groups use AI-driven tools like WormGPT and FraudGPT.…

Essential Insights AI-driven cyberattacks are accelerating and becoming more sophisticated, outpacing traditional detection tools. EDR solutions struggle against AI-enabled techniques like living-off-the-land, fileless malware, and credential theft, which evade detection. Zero Trust architecture refines security by implementing deny-by-default, least privilege, and application allowlisting, effectively limiting attack surfaces. Combining Zero Trust with EDR enhances proactive defense, providing critical extra protection and time to respond to evolving AI threats. What’s the Problem? Recent reports highlight a rapidly escalating cyber threat landscape driven by AI-generated attacks. These attacks, which are increasingly sophisticated and harder to detect, target organizations indiscriminately, exploiting trust in normal…

Fast Facts A Windows vulnerability dubbed “PhantomRPC” allows privilege escalation by exploiting RPC connection handling, with no current fix from Microsoft, emphasizing monitoring RPC activity and restricting impersonation rights. Checkmarx’s GitHub repository data was leaked on the dark web following a compromise involving tampered extensions, potentially exposing source code and credentials, but customer environments remained unaffected. A popular PyPI package was hijacked through a supply chain attack, distributing a malicious version that steals credentials and crypto wallets; users are advised to rotate secrets and restore affected systems. Multiple cybercriminal activities include the extradition of a Chinese hacker linked to the…

Summary Points The rapid deployment of AI tools creates a cycle where security risks emerge quickly, necessitating proactive strategies like default deny and ringfencing to safeguard organizational data and infrastructure. Open communication and regular risk assessments, such as roundtables and risk registers, are essential for early detection of vulnerabilities and systematic mitigation efforts. Balancing security controls without overburdening teams involves simplifying processes, leveraging proactive measures (like allowlisting), and continuously reviewing security controls to adapt to evolving threats. Establishing a culture of transparency, curiosity, and accountability—where mistakes are openly reported and learning is prioritized—empowers teams to safely incorporate AI tools while…

Top Highlights Two ex-cybersecurity professionals, Ryan Goldberg and Kevin Martin, received 4-year prison sentences for orchestrating ransomware attacks in 2023, primarily using ALPHV/BlackCat malware to extort millions from various U.S. organizations. Goldberg and Martin exploited their cybersecurity expertise to attack critical sectors, causing data leaks and financial losses, with Martin alone helping extort over $75 million across multiple victims. Goldberg attempted to flee internationally but was apprehended after a multi-country chase, demonstrating law enforcement’s extensive efforts to combat cybercriminals. The case highlights the dark side of ransomware negotiation, where insiders misuse their skills to facilitate extortion, emphasizing the need for…

Quick Takeaways AI-enabled cyberattacks are now automating large-scale, rapid exploitation of vulnerabilities, increasing attack speed and scale. Cybercriminals can autonomously identify zero-day vulnerabilities and chain exploits, making attacks more sophisticated and accessible. MSMEs are highly at risk due to limited security measures, facing threats like data theft, operational disruption, and ransomware from AI-driven attacks. Threat, Attack Techniques, and Targets India’s cybersecurity authority, CERT-In, warns about AI-driven cyber threats. These threats are becoming more sophisticated and easier to carry out. AI technology now allows cybercriminals to automate attacks. They can scan for vulnerabilities, find zero-day exploits, and connect different attack methods…

Summary Points The FIDO Alliance is collaborating with Google and Mastercard to develop industry standards for AI agent payment validation, utilizing Google’s Agent Payments Protocol and Mastercard’s Verifiable Intent framework. German authorities suspect Russian involvement in phishing attacks against Signal, compromising around 300 accounts, while German and Dutch investigations highlight rising state-sponsored cyber threats. A critical, unpatched RCE flaw in Hugging Face’s open-source LeRobot platform’s async inference component poses remote code execution risks, with plans for a fix in version 0.6.0. Increasing cybercrime costs: US scam losses hit $2.1 billion in 2025, while privacy enforcement fines surged to $3.45 billion,…

Essential Insights The Phoenix System is a new, scalable phishing-as-a-service platform that enables cybercriminals to launch widespread, region-specific smishing campaigns targeting banks, telecoms, and delivery companies with minimal technical effort. It features a centralized administrative panel for managing multiple campaigns across various countries, utilizing geofencing and IP filtering to evade detection and tailor attacks. Phoenix employs advanced delivery methods such as rogue Base Transceiver Station (BTS) injection, allowing SMS messages to bypass carriers and appear legitimate, increasing infection rates. Since early 2024, Phoenix has targeted over 70 organizations globally, using pre-built phishing kits sold via Telegram for around $2,000 annually,…