• Wazuh
• CVE-2025-24016
• United States
• North America
• Business Services
• Cve-2025-24016
• Mirai

Exploitation of Wazuh Vulnerability by Mirai Botnet Variants

Researchers have reported that threat actors are exploiting a critical vulnerability (CVE-2025-24016) in Wazuh servers to deploy Mirai botnet variants for conducting distributed denial-of-service (DDoS) attacks. This vulnerability allows remote code execution and has been targeted shortly after its public disclosure in February 2025. The attacks involve two different botnets using malicious shell scripts to download Mirai payloads from external servers. The research indicates that the botnets are leveraging various exploits, including those targeting IoT devices, and have been found to particularly focus on devices in regions such as China, India, and several others. The ongoing exploitation of this vulnerability highlights the rapid response of botnet operators to newly published security flaws.

• Fin6
• United States
• North America
• Linkedin
• More_Eggs
• Manufacturing

Fin6 Leverages Fake Resumes for Malware Delivery

The financially motivated threat actor Fin6 has been observed using fake resumes hosted on Amazon Web Services (AWS) to deliver the malware family known as More_Eggs. By posing as job seekers on platforms like LinkedIn and Indeed, Fin6 builds rapport with recruiters and sends phishing messages that lead to malware downloads. More_Eggs, developed by another cybercrime group called Golden Chickens, is a JavaScript-based backdoor capable of credential theft and system access. Fin6 has a history of targeting e-commerce sites to steal payment card data and has been operational since 2012.

• North America
• Cryptocurrency
• United States
• Alex Lab

ALEX Protocol Reports Theft of Over 8 Million Dollars

In June 2025, ALEX Protocol became the victim of a data breach when threat actors exploited a vulnerability in the platform's self-listing verification logic, resulting in losses of approximately $8.37 million. According to ALEX Protocol, around 8.4 million stacks (stx) tokens, 21.85 stacks bitcoin (sbtc), 149,850 in USDC and USDT, and 2.8 wrapped bitcoin (wbtc) were taken, including various cryptocurrencies.

• Spearphishing Link
• Ingress Tool Transfer
• Telecommunications
• Spectrum
• Credentials In Files
• Amos
• North America
• United States
• Unix Shell
• Disable Or Modify Tools
• Match Legitimate Name Or Location
• Sudo And Sudo Caching

New Clickfix Infostealer Campaign Targets macOS Users

Cybersecurity researchers have identified a new malware campaign that uses social engineering tactics to distribute an information stealer known as Atomic macOS Stealer (AMOS) targeting Apple macOS systems. The campaign employs typosquatting domains that mimic the U.S.-based telecom provider Spectrum, tricking users into executing a malicious shell script that steals system passwords and downloads the AMOS variant. The attack begins on a fake webpage that prompts users to complete a CAPTCHA verification, ultimately leading them to execute harmful commands under the guise of fixing a non-existent issue. The campaign is believed to be orchestrated by Russian-speaking cybercriminals, as indicated by the presence of Russian language comments in the malware's code.

• Healthcare
• North America
• United States
• Ups
• Wow Health Solutions

Threat Actor Claims Breach of WoW Health

In June 2025, WoW Health became the victim of a data breach when a threat actor named "ups" managed to gain access to its database. According to the threat actor, approximately 423,650 customers' data was taken, including last names, first names, email addresses, physical addresses, and sensitive healthcare information.

• Transportation
• Rip_Real_World
• United States
• North America
• Cyprus Airways

Threat Actor Claims Breach of Cyprus Airways

In June 2025, a threat actor named "Rip_Real_World" claimed to be selling data from Cyprus Airways, including over 45 GB of information. The breach allegedly includes passenger records from 2018 to June 2025, such as names, emails, phone numbers, travel dates, payment amounts, and document details. The actor also claimed to have real-time access to flight systems and data on 12 authorized personnel. The leak comprises 41 GB of passenger data and 2 GB of electronic ticket (ET) data.