Weekly Cybersecurity Threats: Zero-Days, AI Attacks & Data Leaks
Critical vulnerabilities exploited globally, from schools to government systems.
1Critical Zero-Day Exploits
This week's report highlights multiple zero-day vulnerabilities actively exploited, including flaws in PaperCut, VMware, and Google Chromium V8. These vulnerabilities allow attackers to execute remote code, escape virtual machines, and compromise systems. The U.S. CISA has added several to its Known Exploited Vulnerabilities catalog, urging immediate patching. Schools and universities in the U.S. and Europe have been primary targets, with credentials stolen en masse.
2Massive Data Breaches
The Manchester Airports Group hack exposed data of 8.8 million people after ransom refusal. Attackers leaked 86GB of sensitive information, including personal and financial details. Similarly, Aesto Health's AWS infrastructure breach compromised 9.5 million records. These incidents underscore the growing trend of large-scale data theft, often followed by extortion attempts or dark web sales.
3AI-Powered Cyber Campaigns
Chinese hackers are deploying AI agents in multi-country cyber campaigns, targeting government and education systems across Asia. AI is also being used to create automated attacks on PLCs (Programmable Logic Controllers), though current capabilities remain limited. Meanwhile, infostealers are hijacking AI tool sessions like Claude, draining subscriptions and stealing login credentials.
4State-Sponsored Threats
Leaked documents reveal Russia's GRU recruiting engineering students as cyber operators. North Korea-linked IT workers are infiltrating Western companies, while Iranian APT Mirage Kitten uses fake job tests to spread malware. These state-backed groups employ sophisticated tactics, from supply-chain attacks (e.g., SonicWall SMA 1000 zero-days) to social engineering, posing long-term risks to critical infrastructure.
5Dark Web Activity
The dark web service Nexus is selling over 153 million driver's licenses, while another group markets Ticketmaster breach data. Cybercriminals are monetizing stolen data at unprecedented scales, with prices as low as $536 for AI-generated PLC attacks. Extortion groups like FulcrumSec publicly claim breaches to pressure victims, exacerbating the fallout from leaks.
6Vulnerability Management Failures
Despite patches being available, 47% of PaperCut servers remain unpatched, leaving them open to probing hackers. A 12-year-old PostgreSQL flaw allowed full server takeovers, highlighting systemic gaps in vulnerability management. Organizations often delay updates due to compatibility concerns, creating windows of opportunity for attackers.
7Emerging Malware Trends
New malware like ValleyRAT disguises itself as adware, while Gryxa toolkit uses AI to evade detection. Spyware themes deliver iOS exploits targeting crypto wallets, and infostealers like PrettyPrague exploit antivirus software. Attackers are increasingly leveraging legitimate tools (e.g., Crowdstrike Falcon) for privilege escalation, blurring the line between trusted and malicious software.
8Global Response & Implications
The FBI's investigations led to extraditions and guilty pleas, such as five Venezuelans in an ATM jackpotting case. However, the sheer volume of attacks—1,051 CVEs flagged by Eclypsium—shows defenses are lagging. As AI lowers barriers to sophisticated attacks, governments and enterprises must prioritize proactive threat hunting and zero-trust architectures to mitigate risks.