FortiWeb zero-day CVE-2025-64446 lets attackers create admin accounts. Charming Kitten (APT42, Mint Sandstorm) runs SpearSpecter against senior officials via WhatsApp rapport-building. Dragon Breath (APT-Q-27) deploys RONINGLOADER to disable AV tools.
