Weekly Cybersecurity Briefing (1 – 7 September 2025)
This week featured multiple high-severity vulnerabilities actively exploited in the wild. Sitecore and SAP S/4HANA zero-days enabled full system compromise in enterprise environments, while TP-Link routers and Android devices were also targeted by ongoing attacks. Apple macOS flaws were leveraged in conjunction with WhatsApp exploits to deploy spyware.
Supply chain breaches continued to impact major organisations. The Salesforce–Salesloft Drift compromise exposed customer data across Zscaler, Cloudflare, Palo Alto Networks, and Workiva, while npm packages and GitHub repositories were used to steal cryptocurrency wallets and authentication tokens in the s1ngularity attack.
State-linked cyber campaigns intensified. North Korean groups APT37 and Contagious Interview deployed phishing and malware campaigns targeting academics, individuals, and intelligence-related infrastructure. Iranian-aligned threat actors abused diplomatic email accounts and multi-factor authentication systems to deliver malware to embassy staff and international organisations.
Global distributed denial-of-service (DDoS) attacks surged, with Cloudflare mitigating a record 11.5 terabits-per-second assault. Attackers exploited cloud infrastructure and compromised devices for sustained volumetric attacks. Analysts noted more than eight million DDoS incidents in the first half of 2025.
Organisations reported significant operational disruptions. Jaguar Land Rover halted production at the Halewood plant and disconnected IT systems following a cyberattack. Pennsylvania Attorney General’s Office experienced ransomware-driven outages affecting email, phone, and court services. Third-party software breaches also affected schools and other enterprises.
Emerging malware and attack frameworks were observed. TAG-150 expanded operations with CastleRAT and CastleLoader, while GhostRedirector compromised Windows servers for SEO fraud. Lazarus Group deployed PondRAT, ThemeForestRAT, and RemotePE targeting cryptocurrency and financial organisations. AMOS and other macOS stealers were distributed via cracked applications.
Regulatory and policy developments included European fines and guidance on software transparency. France fined Google €325 million and SHEIN €150 million for unlawful cookie practices. The US and allied nations promoted Software Bills of Materials (SBOMs) to improve software supply chain visibility and vulnerability management.
Phishing and social engineering continued to evolve. Noisy Bear targeted Kazakhstan’s energy sector via BarrelFire campaigns, iCloud Calendar invites were abused for phishing, and VirusTotal AI uncovered malicious SVG files mimicking Colombia’s justice system. North Korean actors monitored cyber intelligence platforms to track exposure of their infrastructure.
Critical software advisories were issued for multiple platforms. High-severity flaws affected the Linux kernel, PostgreSQL, Apache HTTP Server, Oracle Java, and Microsoft developer tools. Android, macOS, Sitecore, TP-Link, and cloud services received urgent patches. Argo CD and other API services were also found leaking repository credentials.
Source: CyberSecBrief
