Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In July 2025, pro-Palestinian hacktivist group zerodayx1 launched its own Ransomware-as-a-Service (RaaS) operation, following the path of other hacktivist teams. They loudly announced the initiative on platforms commonly used for such purposes, including X (formerly Twitter) and Telegram. Zerodayx1 exemplifies the ongoing evolution of these groups, underscoring the importance of studying and understanding their methods in order to better prepare for and respond to such threats.

BadUSB, Rubber Ducky, and Flipper Zero devices bypass traditional USB blocking by impersonating keyboards and executing commands at machine speed. Netwrix Endpoint Management combines Endpoint Protector’s device control with Policy Manager’s privilege enforcement to block rogue devices, remove unnecessary admin rights, and contain lateral movement before it escalates.

The Shai-Hulud worm wasn't just a sophisticated supply chain attack; its most important lesson was about a crisis of communication. The attack thrived in the organizational gap between security policy and the daily realities of software development, a gap that exists in most companies. Defending against the next software supply chain attack requires more than a new tool; it demands a strategic shift from imposing controls to forging a genuine partnership with engineering.

The Shai‑Hulud worm and the Nx / S1ngularity attacks show how token‑stealing malware, vulnerable workflows, and always‑on elevated permissions allow cascading compromise. Enforcing JIT access on repository, organization owner/admin roles, and team‑based inherited permissions sharply reduces exposure, limits damage, and strengthens audit/compliance posture.

The Shai‑Hulud worm and the Nx / S1ngularity attacks show how token‑stealing malware, vulnerable workflows, and always‑on elevated permissions allow cascading compromise. Enforcing JIT access on repository, organization owner/admin roles, and team‑based inherited permissions sharply reduces exposure, limits damage, and strengthens audit/compliance posture.

On September 18, 2025, an Analysis Report was issued by CISA that details information about two sets of malware it obtained from an organization that was compromised during May 2025. To gain initial access, the threat actors chained together known vulnerabilities outlined in CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (Ivanti EPMM) before deploying the malware, which allowed them to achieve remote code execution (RCE).

BlueVoyant’s Threat Fusion Cell (TFC) and Security Operations Center (SOC) researchers have uncovered a recent cyber campaign featuring a unique twist on fake browser updates. This attack leveraged the GrimResource vulnerability and delivered the PureLogs stealer malware to targeted environments through disguised Microsoft Management Console (MSC) files.

This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups currently operating globally. Trustwave SpiderLabs Cyber Threat Intelligence team has developed a new detailed analysis of Storm-2603, the threat group associated with the recent exploitation of security flaws in Microsoft SharePoint Server.

AMOS Stealer campaign targets macOS, TAG-150 deploys new CastleRAT malware, and GPUGate targets IT firms in Western Europe.