GTIG AI Threat Tracker: Threat Actors Deploy AI-Enabled Malware in 2025
TL;DR Google’s Threat Intelligence Group reports a shift from using AI for productivity to embedding LLMs inside malware, including dropper…
Triofox Vulnerability CVE-2025-12480: Unauthenticated Host-Header Bypass Enables RCE
TL;DR Mandiant reported exploitation of an unauthenticated access flaw in Gladinet’s Triofox (CVE-2025-12480) that allowed attackers to bypass authentication, create…
Time Travel Triage: Using Time Travel Debugging to Analyze .NET Hollowing
TL;DR Time Travel Debugging (TTD) in WinDbg lets analysts record a deterministic execution trace of a user-mode process and replay…
UNC1549 exploits third-party access, VDI breakouts and custom malware
TL;DR Mandiant's follow-up analysis details UNC1549 campaigns from late 2023 through 2025 targeting aerospace, aviation and defense sectors using supplier…
Beyond the Watering Hole — APT24 Shifts to Multi-Vector Espionage Attacks
TL;DR Google's Threat Intelligence Group is tracking a three-year campaign by APT24, a PRC-nexus actor, that uses a custom, heavily…
Sanctioned Intellexa Continues to Deploy Multiple Mobile Zero-Day Exploits
TL;DR Google's Threat Intelligence Group reports that Intellexa, despite US sanctions, remains an active commercial spyware vendor exploiting numerous mobile…
Multiple Threat Actors Exploiting React2Shell (CVE-2025-55182)
TL;DR A critical unauthenticated RCE in React Server Components, CVE-2025-55182 (React2Shell), was disclosed Dec. 3, 2025 and quickly saw widespread…
Microsoft fixes 60+ Windows vulnerabilities in November Patch Tuesday, including zero-day
TL;DR Microsoft released fixes for more than 60 vulnerabilities across Windows and related products in the November Patch Tuesday cycle,…
Mozilla Ends Monitor Plus Ties to Onerep, Service Closing Dec. 17, 2025
TL;DR Mozilla said it will discontinue Monitor Plus — its paid data-broker scanning and removal offering that used Onerep —…