Threat Intelligence Executive Report – Volume 2025, Number 4
This issue of the Counter Threat Unit’s high-level bimonthly report discusses noteworthy updates in the threat landscape during May and June
Similar Posts
Sophos Endpoint: Consistently AAA rated – Q2 2025 SE Labs Endpoint Protection Report
Bys sThe secret of success is consistency!
Chinese APT Lotus Panda Targets Governments With New Sagerunex Backdoor Variants
Bys sThe threat actor known as Lotus Panda has been observed targeting government, manufacturing, telecommunications, and media sectors in the Philippines, Vietnam, Hong Kong, and Taiwan with updated versions of a known backdoor called Sagerunex. “Lotus Blossom has been using the Sagerunex backdoor since at least 2016 and is increasingly employing long-term persistence command shells and…
UK: ‘Catastrophic’ attack as Russians hack files on EIGHT MoD bases and post them on the dark web
Bys sLydia Veljanovski and Sean Rayment report: Russian hackers have stolen hundreds of sensitive military documents containing details of eight RAF and Royal Navy bases as well as Ministry of Defence staff names and emails – and posted them on the dark web, The Mail on Sunday can reveal. In what has been described as a ‘catastrophic’ security……
Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper
Bys sCybersecurity researchers have discovered a malicious package named “os-info-checker-es6” that disguises itself as an operating system information utility to stealthily drop a next-stage payload onto compromised systems. “This campaign employs clever Unicode-based steganography to hide its initial malicious code and utilizes a Google Calendar event short link as a dynamic dropper for its final
Nigerian National Pleads Guilty to International Fraud Scheme that Defrauded Elderly U.S. Victims
Bys sIt’s so hard to believe that people fall for these scams, but it happens so often that we need to just be more diligent about educating the public and reaching out to family members and friends to educate them — especially those who may not spend a lot of time on the internet to read…
Hackers Actively Exploiting 7-Zip Symbolic Link–Based RCE Vulnerability (CVE-2025-11001)
Bys sA recently disclosed security flaw impacting 7-Zip has come under active exploitation in the wild, according to an advisory issued by the U.K. NHS England Digital on Tuesday. The vulnerability in question is CVE-2025-11001 (CVSS score: 7.0), which allows remote attackers to execute arbitrary code. It has been addressed in 7-Zip version 25.00 released in…