Brazil is reeling from one of its largest banking breaches ever, where hackers stole roughly $100 million from the country's PIX instant payment system. Authorities arrested a low-level IT worker who sold his credentials for less than $1,000, granting attackers deep access to financial systems. This case underscores the persistent risks of insider threats and the need for robust monitoring of privileged access in digital payment ecosystems.
Source: Information Security Newspaper
CitrixBleed 2: Public Exploits Circulate for Critical NetScaler Flaw
Multiple proof-of-concept exploits for the critical "CitrixBleed 2" vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway are now publicly available, with researchers warning that a significant number of affected systems remain unpatched. The flaw enables attackers to steal user session tokens and compromise enterprise environments, highlighting the urgency for administrators to update their systems immediately to prevent exploitation.
Source: Bleeping Computer
Scattered Spider Expands Attacks, Targets Multiple Industries With Phishing Domains
The notorious Scattered Spider group, previously linked to major airline breaches, is widening its focus to manufacturing, healthcare, and retail targets via sophisticated phishing campaigns. Security experts have observed hundreds of malicious domains crafted to impersonate organizations ranging from airlines to food chains, underscoring the group’s agility and the ongoing threat from highly adaptive social engineering campaigns.
Source: Checkpoint Blog
Isolated Recovery Environments Become Essential Amid Backup Attacks
As ransomware actors increasingly target production backups to cripple recovery efforts, organizations are turning to isolated recovery environments (IREs) that are physically and logically segregated from primary networks. This shift reflects the growing consensus that traditional backup strategies are insufficient to counter contemporary threats, with IREs emerging as a critical resilience layer allowing secure restoration even after a catastrophic breach.
Source: GoogleCloud Threat Intelligence
Batavia Spyware: New Malware Targets Russian Industrial Enterprises
A previously unknown spyware, dubbed 'Batavia,' is being used in targeted phishing campaigns against Russian industrial and corporate entities. Believed to be active since March, Batavia steals internal documents by leveraging fake contract-themed emails and demonstrates an increasing sophistication in phishing and malware deployment tactics aimed at industrial sectors.
Source: Bleeping Computer
Phishing Surges in Japan, with Sophisticated Supply Chain Attacks on the Rise
Japan’s JPCERT incident report for Q1 2025 reveals a sharp rise in phishing incidents and a 75% increase in website defacements, attributing the growth to better-tailored lures and more advanced attacks against suppliers. Significant threats included targeted exploitation of Ivanti VPNs and use of malware that blends in with legitimate system tools, signaling a need for faster, smarter defenses against evolving cyber threats.
Source: Cyble
CISOs Pressured to Fix API Security Before Regulations Strike
A new industry report warns that most organizations inadvertently expose sensitive data via APIs lacking adequate security, with few even aware of the risks. As regulators move toward stricter oversight, CISOs are urged to address API governance proactively to avoid compliance headaches and safeguard organizational data.
Source: Help Net Security
You May Also Be Interested In...
Ingram Micro Scrambling to Restore Systems After Ransomware Attack
SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools
Samsung Issues Critical Update For All Galaxy Smartphones