F5 BIG-IP Source Code Leak Tied to UNC5221 Utilizing BRICKSTORM Backdoor

Summary The China-nexus threat cluster known as UNC5221 is actively exploiting F5 BIG-IP appliances following a confirmed breach of F5’s internal network that resulted in the theft of BIG-IP source code and vulnerability data, according to a new report from Resecurity. UNC5221 utilizes a custom-built, highly sophisticated toolkit centered on the BRICKSTORM backdoor to exploit F5 BIG-IP devices….

Read More

F5 States Threat Actors Accessed Undisclosed BIG-IP Flaws and Source Code, Provides Mitigations

Summary Cybersecurity firm F5 publicly disclosed a breach by an unnamed nation-state actor who gained long-term access to the company’s product development environment, including the engineering platforms for its flagship BIG-IP product. The attackers exfiltrated a portion of the BIG-IP source code, information about undisclosed security vulnerabilities, and configuration/implementation details for a limited number of customers….

Read More

EvilAI Malware Impersonating AI Tools to Target Manufacturing & Retail and Hospitality Organizations

Summary A highly capable threat campaign, codenamed EvilAI by Trend Micro, is using seemingly legitimate, digitally signed AI-enhanced productivity software, such as PDF editors, to secretly deliver various malware strains globally. These applications, which appear functional, serve as initial access conduits to perform reconnaissance, exfiltrate browser data, and prepare systems for secondary payloads. The campaign has…

Read More

CISA and NCSC Release Directives to Address Multiple Cisco Platforms Exploited by Threat Actors

Context CISA has released Emergency Directive 25-03 in response to an advanced threat actor actively exploiting zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) devices. This alert comes as the United Kingdom National Cyber Security Centre releases a parallel advisory warning of active exploitation. This persistent threat utilizes new malware strains, RayInitiator and LINE VIPER, to maintain control and…

Read More

Salesloft Drift AI Abused for Further Attacks on Salesforce Environments for Major Cyber Security Firms

Executive Summary A widespread, opportunistic data theft campaign against Salesforce, attributed to the group UNC6395, has expanded in scope beyond initial reports. The attacks leverage compromised OAuth tokens from Salesloft Drift, an AI chat agent, to gain unauthorized access to customer instances of various services, including Salesforce and Google Workspace. Cybersecurity firms Zscaler and Palo Alto Networks have publicly confirmed impact,…

Read More