⚡ Top Cybersecurity Threats, Tools and Tips 

This week in cybersecurity: zero-day exploits, advanced malware, and the latest hacking tricks you need to know about.

As the digital world becomes more complicated, the lines between national security and cybersecurity are starting to fade. Recent cyber sanctions and intelligence moves show a reality where malware and fake news are used as tools in global politics. Every cyberattack now seems to have deeper political consequences. Governments are facing new, unpredictable threats that can't be fought with old-school methods.

To stay ahead, we need to understand how cybersecurity is now tied to diplomacy, where the safety of networks is just as important as the power of words.

⚡ Threat of the Week

U.S. Treasury Sanctions Chinese and North Korean Entities — The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) leveled sanctions against a Chinese cybersecurity company (Sichuan Juxinhe Network Technology Co., LTD.) and a Shanghai-based cyber actor (Yin Kecheng) over their alleged links to Salt Typhoon and Silk Typhoon threat clusters. Kecheng was associated with the breach of the Treasury's own network that came to light earlier this month. The department has also sanctioned two individuals and four organizations in connection with the North Korean fraudulent IT worker scheme that aims to generate revenue for the country by dispatching its citizens to China and Russia to obtain employment at various companies across the world using false identities.

AI Risk Assessment

10 Best Practices for Cloud Visibility

Give your cloud visibility a boost with proven strategies. This practical guide outlines 10 best practices that security teams like yours can implement to instantly improve cloud visibility.

🔔 Top News

Sneaky 2FA Phishing Kit Targets Microsoft 365 Accounts

A new adversary-in-the-middle (AitM) phishing kit called Sneaky 2FA has seen moderate adoption among malicious actors for its ability to steal credentials and two-factor authentication (2FA) codes from Microsoft 365 accounts since at least October 2024. The phishing kit is also called WikiKit owing to the fact that site visitors whose IP address originates from a data center, cloud provider, bot, proxy, or VPN are directed to a Microsoft-related Wikipedia page. Sneaky 2FA also shares some code overlaps with another phishing kit maintained by the W3LL Store.

FBI Deletes PlugX Malware from Over 4,250 Computers

The U.S. Department of Justice (DoJ) disclosed that a court-authorized operation allowed the Federal Bureau of Investigation (FBI) to delete a variant of the PlugX malware from over 4,250 infected computers as part of a "multi-month law enforcement operation." The malware, attributed to the China-nexus Mustang Panda threat actor, is known to spread to other systems via attached USB devices. The disruption is part of a larger effort led by the Paris Prosecutor's Office and cybersecurity firm Sekoia that has resulted in the disinfection payload being sent to 5,539 IP addresses across 10 countries.

Russian Hackers Target Kazakhstan With HATVIBE Malware

The Russian threat actor known as UAC-0063 has been attributed to an ongoing cyber espionage campaign targeting Kazakhstan as part of the Kremlin's efforts to gather economic and political intelligence in Central Asia. The spear-phishing attacks leverage lures related to the Ministry of Foreign Affairs to drop a malware loader named HATVIBE that's then used to deploy a backdoor called CHERRYSPY.

Python Backdoor Leads to RansomHub Ransomware

Cybersecurity researchers have detailed an attack that started with a SocGholish infection, which then paved the way for a Python backdoor responsible for deploying RansomHub encryptors throughout the entire impacted network. The Python script is essentially a reverse proxy that connects to a hard-coded IP address and allows the threat actor to move laterally in the compromised network using the victim system as a proxy.

Google Ads Users Targeted by Malicious Google Ads

In an ironic twist, a new malvertising campaign has been found targeting individuals and businesses advertising via Google Ads by attempting to phish for their credentials via fraudulent ads on Google. The brazen tactic is being used to hijack advertiser accounts and push more ads to perpetuate the campaign further. Google said the activity violates its policies and it's taking active measures to disrupt it.

🔥 Trending CVEs

Your go-to software could be hiding dangerous security flaws—don't wait until it's too late! Update now and stay ahead of the threats before they catch you off guard.

This week's list includes — CVE-2025-21333, CVE-2025-21334, CVE-2025-21335 (Windows Hyper-V NT Kernel Integration VSP), CVE-2024-55591 (Fortinet), CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, CVE-2024-13159 (Ivanti Endpoint Manager), CVE-2024-7344 (Howyar Taiwan), CVE-2024-52320, CVE-2024-48871 (Planet Technology WGS-804HPT industrial switch), CVE-2024-12084 (Rsync), CVE-2024-57726, CVE-2024-57727, CVE-2024-57728 (SimpleHelp), CVE-2024-44243 (Apple macOS), CVE-2024-9042 (Kubernetes), CVE-2024-12365 (W3 Total Cache plugin), CVE-2025-23013 (Yubico), CVE-2024-57579, CVE-2024-57580, CVE-2024-57581, CVE-2024-57582 (Tenda AC18), CVE-2024-57011, CVE-2024-57012, CVE-2024-57013, CVE-2024-57014, CVE-2024-57015, CVE-2024-57016, CVE-2024-57017, CVE-2024-57018, CVE-2024-57019, CVE-2024-57020, CVE-2024-57021, CVE-2024-57022, CVE-2024-57023, CVE-2024-57024, CVE-2024-57025 (TOTOLINK X5000R), CVE-2025-22785 (ComMotion Course Booking System plugin), and 44 vulnerabilities in Wavlink AC3000 routers.

📰 Around the Cyber World

Threat Actors Advertise Insider Threat Operations

Bad actors have been identified advertising services on Telegram and dark web forums that aim to connect prospective customers with insiders as well as recruit people working at various companies for malicious purposes. According to Nisos, some of the messages posted on Telegram request for insider access to Amazon in order to remove negative product reviews. Others offer insider services to process refunds. "In one example, the threat actors posted that they would connect buyers to an insider working at Amazon, who could perform services for a fee," Nisos said. "The threat actors clarified that they were not the insider, but had access to one."

U.K. Proposes Banning Ransom Payments by Government Entities

The U.K. government is proposing that all public sector bodies and critical national infrastructure, including the NHS, local councils, and schools, refrain from making ransomware payments in an attempt to hit where it hurts and disrupt the financial motivation behind such attacks. "This is an expansion of the current ban on payments by government departments," the government said. "This is in addition to making it mandatory to report ransomware incidents, to boost intelligence available to law enforcement and help them disrupt more incidents."

Gravy Analytics Breach Leaks Sensitive Location Data

Gravy Analytics, a bulk location data provider that has offered its services to government agencies and law enforcement through its Venntel subsidiary, revealed that it suffered a hack and data breach, thereby threatening the privacy of millions of people around the world who had their location information revealed by thousands of Android and iOS apps to the data broker. It's believed that the threat actors gained access to the AWS environment through a "misappropriated" key. Gravy Analytics said it was informed of the hack through communication from the threat actors on January 4, 2025. A small sample data set has since been published in a Russian forum containing data for "tens of millions of data points worldwide," Predicta Lab CEO Baptiste Robert said. Much of the data collection is occurring through the advertising ecosystem, specifically a process called real-time bidding (RTB), suggesting that even app developers' may not be aware of the practice. That said, it's currently unclear how Gravy Analytics put together the massive trove of location data, and whether the company collected the data itself or from other data brokers. The breach could expose people to risks of surveillance and physical harm.