Welcome to our September 2025 Cybersecurity Newsletter! This edition brings you the latest updates on global cyber incidents, emerging threats, and critical vulnerabilities impacting organizations and individuals alike. From high-profile arrests to massive data breaches and new malware campaigns, we cover the key developments shaping the cybersecurity landscape this month.

• Top 5 News Highlights of August, 2025
• Top 5 Breaches of August, 2025
• Top 5 New Vulnerabilities of August, 2025
• Tools of the Month

Top 5 News Highlights of August, 2025:

1. HTTP/2 “MadeYouReset” Flaw Exposes Servers to Large-Scale DoS Attacks

A newly discovered vulnerability in HTTP/2, dubbed MadeYouReset, allows attackers to bypass the standard limit of 100 concurrent requests per TCP connection and send thousands, potentially overwhelming servers. Tracked as CVE-2025-8671 with a CVSS score of 7.5, the flaw impacts multiple products including Apache Tomcat, F5 BIG-IP, and Netty. Exploitation can trigger denial-of-service conditions for legitimate users and, in some cases, escalate into out-of-memory crashes, making it the latest major HTTP/2 threat following Rapid Reset and CONTINUATION Flood.

Source: The Hacker News   Date: August 14, 2025

• U.S. Seizes $2.8 Million in Crypto from Zeppelin Ransomware Operator

The U.S. Department of Justice has seized over $2.8 million in cryptocurrency, $70,000 in cash, and a luxury vehicle from Ianis Aleksandrovich Antropenko, indicted in Texas for computer fraud and money laundering. Antropenko is accused of operating Zeppelin ransomware between 2019 and 2022, targeting global businesses and organizations by encrypting and exfiltrating data before demanding ransom. Authorities said he attempted to launder proceeds through ChipMixer, crypto-to-cash exchanges, and structured deposits. Zeppelin, a successor of VegaLocker/Buran, became defunct in late 2022 after researchers revealed they had long held decryption keys to help victims recover their data.

Source: Bleeping Computer  Date: August 17, 2025              

• Researchers Uncover VS Code Marketplace Flaw Enabling Malicious Extension Reuse

Security researchers at ReversingLabs have identified a flaw in the Visual Studio Code Marketplace that lets attackers republish deleted extensions under the same names, bypassing publishing rules. The issue came to light after a malicious extension, ahbanC.shiba, mimicking previously flagged extensions, was found delivering a PowerShell payload that encrypted files and demanded Shiba Inu tokens. The loophole, which allows name reuse only after deletion, mirrors a similar weakness in PyPI, but unlike PyPI, VS Code lacks restrictions to prevent the reuse of names previously tied to malicious packages.

Source: The Hacker News  Date: August 28, 2025

• U.S. DOJ Seizes “Rapper Bot” DDoS Botnet, Charges Alleged Developer

The U.S. Department of Justice has seized the Mirai-based “Rapper Bot” botnet and charged its alleged developer, 22-year-old Ethan Foltz of Oregon, as part of Operation PowerOff. Active since 2021, the botnet—also known as Eleven Eleven and CowBot—infected tens of thousands of routers and DVRs, enabling massive DDoS attacks reaching up to 6 Tbps. Authorities say Rapper Bot targeted over 18,000 organizations across 80 countries, including U.S. government agencies, tech firms, and gaming platforms, and later expanded into cryptomining. With AWS support, investigators linked the botnet to more than 370,000 attacks since April 2025, many costing victims thousands of dollars per incident.

Source: Bleeping Computer  Date: August 20, 2025                    

• Threat Actors Exploit Anthropic’s Claude AI to Develop Ransomware-as-a-Service

Researchers have uncovered that Anthropic’s Claude Code AI was abused by cybercriminals to build and commercialize a ransomware-as-a-service (RaaS) platform. Identified as GTG-5004, a UK-based threat actor leveraged the AI tool to implement ChaCha20 with RSA key management, shadow copy deletion, network share encryption, and advanced evasion techniques such as reflective DLL injection and syscall invocation. Anthropic noted the operator’s near-total reliance on AI for developing encryption, anti-analysis, and Windows internals manipulation, capabilities they likely could not have achieved alone. The ransomware kits, complete with consoles and C2 infrastructure, were later sold on dark web forums for $400–$1,200.

Source: Bleeping Computer  Date: August 28, 2025

Back to Top

Top 5 Breaches of August, 2025:

1. 275M Patient Records Breached: Meeting HIPAA Password Manager Standards

In 2024, the healthcare sector suffered over 700 breaches, exposing more than 275 million patient records, with compromised credentials as the leading cause. Such incidents not only result in financial and reputational damage but also disrupt patient care and safety, underscoring the critical role of strong password management. With HIPAA mandating strict requirements for safeguarding electronic Protected Health Information (ePHI), healthcare organizations must move beyond generic policies and adopt actionable, compliant strategies to mitigate credential-based threats and strengthen trust in the system.

Source: Bleeping Computer  Date: August 12, 2025             

• Manpower Confirms Data Breach Impacting Nearly 145,000 Individuals

Staffing giant Manpower has disclosed a data breach affecting 144,189 people after attackers gained unauthorized access to its systems between December 29, 2024, and January 12, 2025. The incident, detected during an IT outage investigation, may have exposed personal information from certain files. Manpower says it has since strengthened its security, is cooperating with the FBI, and is offering affected individuals free credit monitoring and identity theft protection through Equifax.

Source: Bleeping Computer  Date: August 12, 2025

• Connex Credit Union Breach Exposes Data of 172,000 Members

Connex Credit Union has disclosed a data breach impacting 172,000 members after attackers accessed its systems on June 2–3, 2025. While no evidence suggests funds or accounts were compromised, the incident exposed sensitive personal and financial information, including names, account numbers, debit card details, Social Security numbers, and government IDs. The nonprofit, which serves over 70,000 members across Connecticut, says it is continuing its investigation and notifying those affected.

Source: Bleeping Computer  Date: August 11, 2025

• Columbia University Breach Exposes Data of Nearly 870,000 Individuals

Columbia University has disclosed a data breach impacting 868,969 individuals, including current and former students, employees, applicants, and family members. The incident occurred in May 2025, when an unauthorized actor accessed the university’s network and stole sensitive personal, financial, and health information. The breach was discovered after a June 24 outage, prompting an investigation with external cybersecurity experts and notification to law enforcement. The university confirmed that patient records at Columbia University Irving Medical Center were not affected.

Source: Bleeping Computer Date: August 11, 2025

• TransUnion Data Breach Exposes Personal Information of 4.4 million Individuals

TransUnion, one of the three major U.S. credit bureaus, has disclosed a data breach affecting more than 4.4 million people after attackers gained unauthorized access through a third-party Salesforce application. The incident, detected on July 30, 2025, exposed limited personal information but did not compromise credit reports or core credit data. The company has notified affected individuals and is offering 24 months of free credit monitoring and identity theft protection services.

Source: Bleeping Computer   Date: August 28, 2025

Back to Top

Top 5 Malware Highlights of August:

1. XenoRAT Malware Targets Embassies in South Korea Through Ongoing Espionage Campaign

Trellix researchers have uncovered an ongoing cyber-espionage campaign deploying XenoRAT malware against foreign embassies in South Korea. Active since March 2025, the operation has used at least 19 spearphishing attacks with evolving lures, shifting from Central European diplomatic targets to themes tied to the U.S.-Korea military alliance. While some tactics align with North Korea’s Kimsuky group, evidence also points to China-based operators.

Source: Bleeping Computer Date: August 18, 2025

• Sindoor Dropper Malware Exploits Weaponized .desktop Files to Target Linux Systems

A new malware campaign, dubbed “Sindoor Dropper,” is targeting Linux systems through spear-phishing lures themed around the India-Pakistan conflict. Linked to APT36 (Transparent Tribe), the attack uses weaponized .desktop files disguised as PDFs to deliver multi-stage payloads while displaying decoy documents to avoid suspicion. Analysis shows the dropper employs advanced obfuscation, corrupted binaries restored post-delivery, and zero-detection payloads on VirusTotal, making it highly evasive against traditional defenses.

Source: Cyber Security News  Date: August 30, 2025

• PS1Bot Malware Leveraging Malvertising for Stealthy Multi-Stage In-Memory Attacks

Security researchers have uncovered a malvertising campaign deploying PS1Bot, a modular malware framework built with PowerShell and C#. Active since early 2025, PS1Bot executes entirely in memory to avoid detection, supporting functions like data theft, keylogging, reconnaissance, and persistent access. Its design minimizes forensic artifacts while enabling stealthy follow-on attacks, with researchers noting technical overlaps with AHK Bot, previously linked to groups such as Asylum Ambuscade and TA866.

Source: The Hacker News  Date: August 13, 2025

• ERMAC 3.0 Banking Trojan Source Code Leak Reveals Expanded Capabilities

Researchers have analyzed ERMAC 3.0, the latest version of the Android banking trojan, after its source code leak exposed critical details of its infrastructure. The malware now targets over 700 banking, shopping, and crypto apps with expanded features, including SMS and call manipulation, custom push notifications, Gmail data extraction, camera access, and overlay attacks on financial apps. First identified in 2021 as an evolution of Cerberus and BlackRock, ERMAC continues to serve as the foundation for other malware strains like Hook, Pegasus, and Loot.

Source: The Hacker News  Date: August 16, 2025

• GodRAT Trojan Targets Trading Firms with Steganography and Gh0st RAT Code

A new remote access trojan, dubbed GodRAT, is being used in attacks against trading and brokerage firms, with recent activity observed as of August 2025. Distributed via malicious .SCR files disguised as financial documents on Skype, the malware leverages steganography to hide shellcode inside images, enabling stealthy downloads from its command-and-control servers. Detected since late 2024 across regions including Hong Kong, UAE, Lebanon, Malaysia, and Jordan, GodRAT is built on leaked Gh0st RAT code and uses a plugin-based framework to steal sensitive data and deploy secondary payloads like AsyncRAT.

Source: The Hacker News   Date: August 19, 2025

Back to Top

Top 5 New Vulnerabilities of August, 2025:

1. CVE-2025-8067: Out-of-Bounds Read Vulnerability in UDisks Daemon

CVE-2025-8067 is an out-of-bounds read vulnerability (CWE-125) in the UDisks daemon’s loop device handler, caused by improper validation of the index parameter in D-BUS requests. While the function checks the upper bound, it fails to validate negative values, allowing attackers to trigger a crash or potentially escalate privileges by accessing files owned by privileged users. The flaw affects Linux distributions running vulnerable UDisks versions where the D-BUS system interface is exposed to unprivileged users.

• CVE-2025-55177: Security Restriction Bypass Vulnerability in WhatsApp

CVE-2025-55177 is a security restriction bypass vulnerability in WhatsApp that stems from incomplete authorization of linked device synchronization messages. The flaw, affecting WhatsApp for iOS (prior to v2.25.21.73), WhatsApp Business for iOS (prior to v2.25.21.78), and WhatsApp for Mac (prior to v2.25.21.78), could allow an attacker to trigger processing of content from arbitrary URLs on a target device. When combined with CVE-2025-43300, an Apple ImageIO out-of-bounds write, the bug is believed to have been exploited in a sophisticated campaign against targeted users.

• CVE-2025-6543: Critical Control Flow Vulnerability in Citrix NetScaler Exploited in the Wild

CVE-2025-6543 is a critical control flow vulnerability (CVSS 9.2) affecting Citrix NetScaler ADC when configured as Gateway or AAA virtual servers. The flaw, actively exploited as a zero-day since May 2025, enables denial-of-service conditions and arbitrary control flow manipulation. Threat actors deployed malicious web shells on compromised devices and attempted to erase forensic traces, with widespread exploitation observed by August 2025. NCSC-NL attributed the activity to a likely state-sponsored actor targeting critical organizations in the Netherlands.

• CVE-2025-8088: Critical Path Traversal Vulnerability in WinRAR Exploited for Mass Attacks

CVE-2025-8088 is a path traversal vulnerability (CVSS 8.8) in WinRAR for Windows that allows arbitrary code execution via malicious archive files. Exploited as a zero-day, threat actors leveraged spear-phishing campaigns with weaponized RARs that deployed DLLs into Windows startup directories, creating persistent backdoors. The flaw has been abused by groups like RomCom and Paper Werewolf to deliver malware including Mythic agent, SnipBot, and RustyClaw, impacting financial, defense, manufacturing, and logistics firms across Europe, Canada, and Russia.

• CVE-2025-53786: High-Severity Privilege Escalation in Microsoft Exchange Hybrid Deployments

CVE-2025-53786 is a high-severity post-authentication vulnerability (CVSS 8.0) affecting Microsoft Exchange hybrid environments. The flaw enables attackers to escalate privileges from on-premises Exchange admins to Exchange Online by exploiting shared service principals and forging trusted tokens. This allows near-complete compromise of hybrid cloud and on-premises domains with minimal audit traces, leaving over 28,000 internet-facing Exchange servers at risk.

Back to Top

Tools of the Month

1. reconFTW: It is an automated reconnaissance framework that combines subdomain enumeration, vulnerability scanning, and OSINT into one workflow. Its modular design and customizable configs make it efficient for security researchers and pentesters.
2. GarudRecon: It is an automated reconnaissance framework for asset discovery, vulnerability detection, and continuous monitoring. It leverages open-source tools to scan domains, find subdomains, and uncover issues like XSS, SQLi, LFI, RCE, misconfigurations, and more for comprehensive security assessments.

Back to Top

Protect Your Business from Cyber Attacks!

In today’s world, cyber threats are constantly evolving, and staying one step ahead is crucial for your business. At iwebbs.com, we understand the stakes. Our team of certified security experts is here to help you pinpoint weak spots, implement rock-solid protection, and keep your business safe from even the most sophisticated attacks.

Don’t wait until it’s too late. Take control of your cybersecurity today. Reach out to us for a personalized consultation and find out how we can help you protect your organization from cyber risks. Let’s work together to secure your future!

Secure your business with iwebbs!