RondoDoX
CVE-2025-54322 Critical Xspeeder SXZOS ≤2025-12-26 REMOTE CODE EXECUTION ROOT ACCESS Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py. The title and oIP parameters are also exploited, enabling complete system compromise with root-level privileges. Mitigation: Immediately update Xspeeder SXZOS
Infrastructure Pre-Positioning Volt Typhoon Primary Objective Pre-position access for potential disruption during conflict. Core Characteristics Credential abuse, edge device exploitation, LOTL techniques, OT-adjacent access, long-term persistence. Key Targets Energy, water, telecom, transportation. Volt Typhoon Pre-Positioning Disruption Capability Credential Abuse Edge Device Exploitation LOTL OT-Adjacent Access Energy Water Telecom Transportation Telecom
ErrTraffic
TRENDING TOPICS DEC 31, 2025 Update: The Industrialization of ClickFix Social Engineering Through ErrTraffic Researchers at HudsonRock have discovered ErrTraffic, a new ClickFix service that is currently being marketed for approximately $800 on Russian-language cybercrime forums. ErrTraffic lowers the barrier to entry for threat actors by providing a polished, SaaS-like
HoneyMyte APT
TRENDING TOPICS DEC 30, 2025 HoneyMyte APT Adopts Kernel-Mode Rootkit to Stealthily Deploy ToneShell Backdoor Kaspersky has identified a new HoneyMyte APT campaign that marks a significant escalation in technical sophistication, centered on the use of a kernel-mode mini-filter driver to deploy and protect malware. The malicious driver, signed with
Mycelial Mage
TRENDING TOPICS DEC 29, 2025 Tracing the Mycelial Mage Credential Theft Operation and Its Evolving Exfiltration Infrastructure Researchers found a credential theft operation, tracked here as Mycelial Mage, through sustained observation of phishing kit deployments beginning in early 2025. The activity centers on phishing pages designed to impersonate Microsoft Outlook
Cloudflare
TRENDING TOPICS DEC 24, 2025 Phishers Exploit Cloudflare Pages and Telegram to Scale Credential Theft Threat actors are increasingly abusing free developer hosting platforms, most notably Cloudflare Pages, to host highly convincing phishing portals that impersonate banking, insurance, and healthcare providers. These campaigns frequently leverage compromised legitimate websites as redirectors,
MacSync
TRENDING TOPICS DEC 23, 2025 MacSync Stealer Escalates macOS Risk Through Trusted App Abuse Jamf Threat Labs has identified a significant evolution in the MacSync Stealer malware that materially increases risk for macOS users by abusing Apple’s built-in trust mechanisms. In this campaign, the malware is delivered as a
Prince of Persia
TRENDING TOPICS DEC 22, 2025 Prince of Persia Maintains Persistent Iranian APT Operations Through Continuous Malware Evolution Recent research confirms that the Iranian-aligned Prince of Persia threat actor never truly went dormant after 2022, but instead transitioned into a lower-visibility operational posture while continuing to evolve its tooling, infrastructure, and
Maritime
CVE-2025-20393 Critical Cisco AsyncOS COMMAND INJECTION EXPLOITED IN WILD Cisco AsyncOS flaw allows remote attackers to execute arbitrary commands with root-level privileges due to improper input validation, granting full control over the underlying operating system. Exploitation has been observed in the wild and is limited to appliances where the Spam
Cryptomining
TRENDING TOPICS DEC 18, 2025 Ongoing Cryptomining Campaign Targeting EC2 and ECS via Compromised IAM Credentials Amazon’s AWS GuardDuty security team has identified an active cryptomining campaign targeting AWS customer environments by abusing valid, compromised IAM credentials rather than exploiting a software vulnerability. The operation began on November 2
GhostPoster
TRENDING TOPICS DEC 17, 2025 GhostPoster: Steganography-Enabled Malicious Firefox Extension Intelligence from Koi Security shows that the GhostPoster campaign is abusing Firefox extensions to gain high-privilege, persistent access to users’ browsers while remaining difficult to detect. The operation centers on extensions such as “Free VPN Forever” that appear benign but
APT44
TRENDING TOPICS DEC 16, 2025 Russian State-Backed Campaign Exploits Network Edge Weaknesses to Target Critical Infrastructure Amazon’s threat intelligence team has revealed a long-running Russian state-sponsored cyber campaign that targeted Western critical infrastructure from 2021 through 2025, with a strong focus on the energy sector. The activity is attributed