Monthly Cybersecurity Briefing (28 July – 31 August 2025)
August 2025 was marked by a sharp increase in zero-day exploitation and ransomware campaigns targeting enterprises, critical infrastructure, and cloud platforms. Multiple vendors, including Cisco, Microsoft, Citrix, and Apple, released emergency patches for actively exploited vulnerabilities, highlighting persistent systemic weaknesses.
Large-scale data breaches continued to affect millions of individuals. Notable incidents included Allianz Life, TransUnion, Farmers Insurance, Bouygues Telecom, and Columbia University, often linked to third-party system compromises and phishing campaigns exploiting Salesforce integrations. Personal, financial, and health information were commonly exposed.
AI and LLM security became a focal concern as researchers demonstrated prompt injection, jailbreaks, and other methods to bypass safeguards in GPT-5, GitHub Copilot, and Claude Code. Malicious AI-assisted campaigns increased the sophistication and reach of phishing, credential theft, and ransomware operations.
Ransomware activity remained intense, with groups such as Akira, RomCom, Charon, and BlackSuit conducting targeted attacks. Law enforcement disrupted Royal and BlackSuit ransomware gangs, seizing infrastructure and cryptocurrency. INTERPOL’s Operation Serengeti 2.0 dismantled networks across Africa, recovering millions in illicit funds.
Critical infrastructure vulnerabilities were widely reported. Exploits affecting Dell ControlVault3, Cisco RADIUS, Rockwell and Siemens OT systems, and Docker Desktop highlighted persistent operational technology risks. Industrial, telecommunications, and government networks continued to face espionage campaigns from state-linked actors, including Salt Typhoon and Static Tundra.
Malware, supply chain, and mobile threats expanded, with campaigns such as Anatsa, Hook v3, PipeMagic, and TamperedChef leveraging trojanised apps, phishing, and legitimate tools for persistent compromise. These incidents underscored the growing intersection of software supply chains and AI-assisted attack vectors.
Source: CyberSecBrief
