Cybersecurity News | Daily Recap [17 Dec 2025]

hendryadrian.com

hendryadrian.com

State-sponsored Threats

• Russian GRU-linked groups like Sandworm/APT44 have pivoted from zero-days to weaponizing misconfigured edge devices, persistently targeting energy, telecom and cloud infrastructure across 2021–2025, with some operations disrupted by private defenders – GRU Edge, Sandworm Pivot, Amazon Disrupts, GRU Exposed

Malware & Extensions

• New Android RaaS Cellik (sold for $150/month) offers screen streaming, keylogging and trojanizes Google Play apps to deliver persistent surveillance – Cellik RAT, Cellik Build
• The GhostPoster campaign hid malicious JavaScript in Firefox add-on assets to hijack affiliate links, perform ad fraud and open backdoors in extensions with 50,000+ downloads – GhostPoster, GhostPoster BC
• A rogue NuGet package posing as Tracer.Fody has been stealing cryptocurrency wallet data for years via a typosquatting supply‑chain backdoor – Tracer.Fody

Phishing & Scams

• APT28 ran a long-running credential phishing campaign targeting Ukrainian UKR-net users to harvest logins and maintain access — APT28 Phish
• New ForumTroll phishing lures impersonating eLibrary emails targeted Russian scholars to deliver credential-stealing payloads – ForumTroll Phish
• European police dismantled a Ukraine-based call center network behind roughly $11 million in fraud, showing continued organized call-center scams across borders – Call Center Bust

Vulnerabilities & Patches

• CISA warned of a plaintext-credentials issue in Mitsubishi Electric GT Designer3 that can expose project credentials for GOT2000/GOT1000 devices – Mitsubishi GT
• Critical RADIUS-related flaws in Hitachi Energy AFS/AFR/AFF series can allow forgery attacks impacting data integrity and operations – Hitachi Flaw
• CISA’s Known Exploited Vulnerabilities catalog and recent reports highlight multiple affected vendors (including Fortinet) and urge remediation – CISA Catalog
• Attackers are actively exploiting recently patched Fortinet auth bypass flaws (CVE-2025-59718, CVE-2025-59719) to steal configs and bypass cloud SSO, and Microsoft urged admins to contact support over an MSMQ/IIS update that breaks apps – Fortinet Exploits, MS IIS Fix

Incidents & Breaches

• A cyberattack on Venezuela’s state oil firm PDVSA disrupted administrative systems and suspended some cargo deliveries amid mutual accusations with the U.S. — investigations ongoing – PDVSA Hit, PDVSA Blame
• South Korea’s KT suffered a suspected state-level espionage breach targeting femtocells and telecom data, raising systemic-security concerns – KT Breach
• France’s Interior Ministry is probing an email compromise that exposed confidential files, prompting judicial and technical investigations – France Email
• Japanese firm Askul saw a ransomware attack leak over 700,000 records after refusal to pay the RansomHouse extortionists – Askul Ransom
• A flaw at photo-kiosk vendor Hama Film exposed hundreds of customer photos online, underscoring basic data‑protection failures – Photo Kiosk

Cloud & Supply‑Chain Risk

• Compromised AWS IAM credentials are being used to deploy large-scale cloud crypto‑mining operations, highlighting poor identity hygiene risks in cloud environments – IAM Crypto
• The evolution of third‑party risk from open‑source to AI stresses the need for SBOMs, SAST/DAST and manual reviews to mitigate supply‑chain threats like slopsquatting – Third-Party Risk
• Startup Dux launched with $9 million to use AI agents for exposure management and exploitability analysis to reduce enterprise attack surface – Dux Launch

Policy & Predictions

• Five cybersecurity predictions for 2026 forecast a shift from perimeter defenses to identity‑centric security and emphasize rising AI/deepfake threats that force new trust models – 2026 Predictions
• India’s DPDP rules are quietly reducing risks from deepfakes and synthetic identities by enforcing consent and provenance requirements that improve data governance – DPDP Impact
• U.S. House Homeland Security leadership is keeping cyber legislation and offensive cyber capabilities on the agenda while tracking Chinese threat actors and AI risks – Legislative Focus
• Texas sued major TV makers over surreptitious Automated Content Recognition (ACR) data collection, alleging privacy invasions and potential exposure to foreign access—targets include Sony, Samsung, LG and others – TV Lawsuit

Security Operations & Community

• SOCs are urged to move from reactive firefighting to proactive, contextual threat intelligence—tools like ANY.RUN’s Threat Intelligence Lookup help prioritize industry‑ and country‑specific threats – Fix SOC Blind Spots
• Growing CISO communities provide trusted peer sharing, threat intel exchange and mental‑health support, becoming a force multiplier for enterprise security teams – CISO Communities

Fraud & Social Engineering

• Former fraudster‑turned‑defender Alex Hall details how personal trauma and neurodiversity shaped his fraud tactics and now informs his work improving account‑takeover detection and trust/safety architectures – Alex Hall

Cybersecurity News | Daily Recap – hendryadrian.com