Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities, emerging threats, and significant data breaches to keep you informed and secure in the ever-evolving digital landscape.
1. CISA and NSA Warn of China-backed Malware Campaign
Published: 2025-12-04
CISA, NSA, and Canadian officials issued a joint warning about the BRICKSTORM malware used by Chinese state-sponsored actors, which steals virtual machine snapshots for credential theft and creates hidden rogue VMs targeting VMware vSphere and Windows systems in government and IT organizations. The malware employs multiple encryption layers and DNS-over-HTTPS to hide communications, with threat actors maintaining access from April 2024 through September 2025 in one case.
2. API Breach at 700Credit Exposes Over 5 Million People
Published: 2025-12 (disclosed)
700Credit, a credit verification provider, suffered a breach affecting 5.6 million people due to a flawed API connection exploited in July 2025, allowing unauthorized access to client data including names, addresses, dates of birth, and Social Security numbers from May to October 2025. The company discovered the breach on October 25, notified the FBI and FTC, and is offering one year of credit monitoring.
3. Decryption Bug Found in Ransomware Strain Favored by Pro-Russia Hacktivists
Published: 2025-12 (discovered)
Researchers found a critical flaw in VolkLocker ransomware, launched by pro-Russia hacktivist group CyberVolk in August 2025, allowing victims to decrypt files without payment due to hard-coded master encryption keys written to a plaintext file. The Golang-based ransomware, sold via Telegram for $800 to $2200, indicates quality control issues as the group recruits affiliates.
4. React2Shell Vulnerability Exploited Within Hours of Discovery
Published: 2025-12-03
CVE-2025-55182, or React2Shell, is a maximum-severity vulnerability in React Server Components enabling unauthenticated remote code execution, affecting React 19.x and Next.js 15.x/16.x with App Router. China-linked groups like Earth Lamia and Jackpot Panda exploited it within hours for cryptocurrency miners and backdoors, with CISA adding it to its Known Exploited Vulnerabilities catalog on December 5 and North Korean actors also reported involved.
5. NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems
Published: 2025-12-12
NanoRemote malware leverages Google Drive for command-and-control, using encrypted communications and modular architecture for remote execution, data exfiltration, and persistence, complicating detection in enterprises relying on Google Workspace.
6. Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High-Severity Flaw
Published: 2025-12-12
Google issued an urgent update for Chrome due to active exploitation of a zero-day vulnerability in the rendering engine, allowing arbitrary code execution and system access on Windows and macOS, with risks of ransomware and data theft.
7. Hackers Exploit Unpatched Gogs Zero-Day to Breach 700 Servers
Published: 2025-12-12
A critical RCE vulnerability in unpatched Gogs instances is being exploited to run arbitrary commands, compromise repositories, and target development environments, with risks of source code theft and downstream attacks.
8. Nvidia Deepfake Attack Draws Many More Views than the Real Thing
Published: 2025-12-16
A deepfake video of Nvidia CEO Jensen Huang during the GPU Technology Conference in December 2025 reached 100,000 viewers—eight times more than the real announcement—and included a QR code leading to a cryptocurrency scam site.
Stay Vigilant
Cyber threats are evolving rapidly. Subscribe to our newsletter for daily updates, and consider using advanced monitoring tools to scan for vulnerabilities and automate security patches. Stay safe online!