For the latest discoveries in cyber research for the week of 15th December, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- The Indian government confirmed cyber incidents involving GPS spoofing at seven major airports, including Delhi, Mumbai, Kolkata, and Bengaluru. The attack affected aircrafts using GPS-based landing procedures. Despite signal disruption to navigation data, authorities stated no flights were cancelled or diverted, with contingency measures and Air Traffic Control safeguards preventing operational impact.
- US-based healthcare technology provider, TriZetto Provider Solutions, has notified healthcare clients of a long-running unauthorized access to a customer web portal. With this access a threat actor accessed historical eligibility transaction reports containing protected health information (PHI). Exposed data includes patient and insured PII.
- 700Credit, a US-based credit check and identity verification provider, suffered a data breach affecting at least 5.6 million people. The incident exposed private information after an unidentified attacker accessed dealer-collected data between May and October 2025. The company is notifying impacted individuals and offering credit monitoring, while Michigan’s attorney general urged affected users to enable credit freezes or monitoring to mitigate fraud risk.
- Pierce County Library System in Washington has disclosed a cyberattack impacting over 340,000 individuals after threat actors accessed its systems, forcing a full shutdown. The breach exposed user data and extensive employee PII. The attack was claimed by the INC ransomware gang, which has targeted multiple US government entities in 2025.
Check Point Threat Emulation provides protection against this threat (Ransomware.Wins.INC)
- The French Interior Ministry confirmed a cyberattack targeting its email servers, allowing an attacker to access a number of internal files. Authorities stated there is no evidence of serious data compromise at this stage. An investigation is ongoing, with no attribution yet identified.
- Russian Government IT contractor Mikord was reportedly breached by an anonymous hacker group. The group claims to have maintained access for months, exfiltrated source code, internal communications, financial and technical records, and damaged infrastructure tied to a firm allegedly involved in Russia’s unified military draft database. While Mikord’s director confirmed a hack, Russia’s Ministry of Defense denied any breach or data leak.
- An employee of Home Depot, the US home improvement retailer, had mistakenly exposed a private GitHub token, granting access to internal systems for nearly a year. The token enabled entry to hundreds of private code repositories and key cloud systems and was revoked upon discovery.
VULNERABILITIES AND PATCHES
- Google released an urgent Chrome update on to address a high severity flaw (CVE-2025-14174) actively exploited in the wild and linked to the ANGLE graphics library used for WebGL. The bug likely enables memory corruption that could allow remote code execution.
- Apple released emergency security updates to patch two actively exploited zero-day vulnerabilities, CVE-2025-43529 and CVE-2025-14174. The vulnerabilities were exploited in sophisticated targeted attacks against specific individuals. Both flaws affect WebKit and enable remote code execution or memory corruption via malicious web content, impacting iPhones, iPads, Macs, and other Apple platforms.
- SAP released details and patches for three vulnerabilities, including CVE-2025-42880 (code injection in Solution Manager, CVSS 9.9), CVE-2025-55754 (Commerce Cloud Tomcat flaws, CVSS 9.6), and CVE-2025-42928 (jConnect deserialization, CVSS 9.1), alongside several high severity issues.
THREAT INTELLIGENCE REPORTS
- Check Point Research reports a global rise in cyber attacks in November 2025, averaging 2,003 weekly attempts per organization, with education most targeted sector and rising exposure from generative AI. 727 ransomware incidents were recorded, a 22% increase YoY, with North America accounting for 55% of cases and industrial manufacturing being the top victim industry.
- Check Point Research exposed ValleyRAT’s modular system, including a kernel-mode rootkit that can remain loadable on fully updated Windows 11 despite built-in protections. The research linked leaked builder artifacts to plugins and identified about 6,000 samples, with roughly 85 percent emerging in the last six months after the builder’s public release.
- Check Point researchers revealed a phishing campaign where attackers impersonate file-sharing and e-signature services to deliver finance-themed lures that look like legitimate notifications. The attackers sent over 40,000 phishing emails targeting roughly 6,100 customers over the past two weeks, abusing Mimecast’s secure-link rewriting feature as a smokescreen to make their links appear safe and authenticated
- Researchers have analyzed STAC6565 campaign, which with high confidence is associated with the GOLD BLADE threat group (aka RedCurl, RedWolf, and Earth Kapre). The campaign is mostly targeting Canadian organizations, blending data theft with selective QWCrypt ransomware. The threat actor uses multi-stage infection chains that include payloads downloaded via WebDAV, DLL side-loading using legitimate Adobe components, and BYOVD abuse to evade detection.
- Researchers uncovered a new phishing technique called ConsentFix that tricks people into giving attackers access to their Microsoft accounts. The method uses a browser-native prompt that persuades victims to copy and paste a link. Once the link is submitted, attackers can get access without needing a password or multi-factor authentication.
