CYBER THREATCAST

Patch or remove WinRAR 7.13 and earlier immediately, and hunt for executables dropped from archive handling into Windows auto-run locations. CISA says CVE-2025-8088 is being exploited in ransomware attacks, and ESET previously attributed zero-day exploitation to RomCom against organizations in Europe and Canada. Defense, finance, and logistics teams should treat suspicious archive attachments and unexpected startup-folder binaries as high-risk intrusion evidence.

Remove internet exposure from PLCs, HMIs, and OT protocols now, especially Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 devices, and require passwords, firewalls, and VPN-protected operator access. Public water systems in at least a dozen U.S. states have reportedly been targeted, with attackers changing passwords, disabling operator access, manipulating PLCs, and reportedly causing flooding in one case. Water and wastewater operators should verify remote access paths for Modbus TCP, DNP3, EtherNet/IP, Niagara Fox, and related OT assets.

Create new secure seed phrases and migrate assets out of affected wallets rather than relying on app updates alone. CryptoJS.lib.WordArray.random() used weak randomness that reduced recovery-phrase entropy in Bexo Wallet, Bitcoin Libre, Milo, NanChat, and RRWallet, making generated seed phrases guessable. Ill Bloom thefts have drained at least $5.7 million since late May, and already-generated recovery phrases remain unsafe even after software changes.

Audit cloud, AI, and developer environments for exposed credentials, unauthenticated RCE exposure, and poisoned dependencies in PyPI, Composer, AUR, Docker, GitHub Actions, Jenkins plugins, and Next.js workflows. Oligo linked TeamPCP to Redis attacks dating to 2020 and later activity involving cryptomining, credential theft, data exfiltration, ransomware, extortion, and dependency poisoning. Organizations using these ecosystems should tighten package provenance checks and prioritize credential rotation where build or deployment systems may have touched untrusted code.

Inspect public-facing Java and Apache Tomcat applications connected to Oracle Database for SQL injection paths, unexpected schema objects, and signs of Windows command execution. Attackers used SQL injection in a Java/Tomcat application to implant the khunt remote-control toolkit inside Oracle schema objects, escalate to SYSTEM-level Windows Server control, and steal SAM, SECURITY, and SYSTEM registry hives. Oracle-backed application owners should review database-resident code, web logs, and credential exposure urgently.