#nation-state attacks

This week saw large-scale data breaches, critical infrastructure attacks, and new zero-day exploits across major platforms. Financial services, telecommunications, and healthcare were among the most affected sectors.

Allianz Life confirmed a Salesforce-linked breach impacting 1.1 million customers, with stolen data later appearing on Have I Been Pwned. Other breaches hit Orange Belgium, iiNet, and Intel, each exposing hundreds of thousands of records. DaVita separately disclosed that ransomware operators accessed 2.7 million patient records.

Apple released emergency updates for CVE-2025-43300, a zero-day flaw in the ImageIO framework exploited in targeted attacks. Microsoft issued urgent fixes for broken Windows recovery tools, while Google and Mozilla patched high-severity browser flaws. Cisco and N-able addressed actively exploited vulnerabilities, and SAP NetWeaver flaws were confirmed to have public exploits.

Law enforcement and policy actions also made headlines. INTERPOL’s Operation Serengeti 2.0 dismantled cybercrime operations across 18 African nations, with over 1,200 arrests. In the United States, a Scattered Spider member was sentenced to ten years in prison, and investigators seized ransomware-linked cryptocurrency.

Threat researchers documented multiple malware and supply chain risks. PipeMagic masqueraded as a ChatGPT desktop app to deploy ransomware. Malicious npm, Python, and Go packages delivered backdoors and credential stealers. Campaigns targeting Redis and GeoServer exploited vulnerabilities to build botnets and monetise bandwidth.

State-sponsored activity continued. Russian group Static Tundra exploited unpatched Cisco devices to infiltrate critical infrastructure, while China-linked Murky Panda leveraged cloud trust relationships for espionage. Pakistani APT36 used malicious Linux files to target defence and government entities.

Farmers Insurance confirmed a breach affecting 1.1 million customers linked to Salesforce-related attacks. Other breaches included Chip Programming firm Data I/O, Aspire Rural Health System, and retailer Auchan.

Nation-state campaigns escalated. Transparent Tribe and APT36 targeted Indian government systems, while Chinese actor UNC6384 used PlugX malware against diplomats in Southeast Asia.

Critical flaws and phishing surged. Docker patched a container escape bug, ScreenConnect admins were hit with spoofed login alerts, and coordinated scans probed Microsoft Remote Desktop services.

Mobile malware activity grew. The Anatsa trojan expanded to 830 apps, 77 malicious Android apps with 19 million installs were removed, and Shamos infostealer spread via fake macOS help sites.

Arch Linux endured a week-long DDoS disrupting community services. Phishing with UpCrypter continued to deliver remote access trojans through fake voicemail and purchase order lures.

Attackers are exploiting a critical SAP S/4HANA flaw, while CISA ordered urgent patching of a Sitecore zero-day. Jaguar Land Rover operations were disrupted by a cyberattack, and Wealthsimple confirmed a breach. North Korean hackers ran fake job interview lures, as researchers uncovered new phishing campaigns, CastleRAT malware, and macOS stealers.

China’s Salt Typhoon group continues targeting global infrastructure through router exploits. TransUnion confirmed a breach affecting over 4.4 million people. Nevada suffered a ransomware attack, with federal agencies assisting recovery. AI misuse surged with an AI-assisted supply chain attack and criminal use of Claude AI. Thousands of Citrix NetScaler appliances remain vulnerable to active exploitation.

Microsoft Defender now directly warns IT admins about nation-state attacks

Microsoft will soon warn Office 365 admins more directly about possible nation-state hacking activity, according to an update on its roadmap seen by ZDNet. Rather than just receiving an email as before, IT administrators will get notifications direct…