BotNet News

Cyberthreat News is a weekly digest of the most significant threats impacting businesses. It includes cyber threat intelligence, a critical component of cybersecurity programs and risk management decisions that help prevent cyber incidents and reduce their impacts.

As cyberattacks become more frequent and increasingly damaging, companies have a vested interest in understanding the threat landscape. That way, they can develop effective countermeasures and safeguard their reputations.

This week, our Cyberthreat News highlights ransomware attacks that have impacted many organizations and customers, as well as cyberattacks against critical infrastructure. These incidents have created unwanted expenses, like monetary ransom payments, loss of revenue from disruptions, and the costs of implementing and maintaining security controls. In addition, they can also lead to long-term damage to brand reputations and customer trust.

The most costly and dangerous cyberattacks involve information theft and the exploitation of data integrity, such as changes to sensitive content. This is a trend that is only growing as attackers leverage the sophistication of artificial intelligence (AI) to find ways around traditional business systems.

2025’s most damaging incidents often begin with compromised vendors or shared platforms. Examples include the hack of U.S. Treasury vendor networks, the attack on the U.S.-based Cloudflake customers, and the malware that shut down the Colonial Pipeline, causing gas shortages in 2022. Attacks against retailers and SaaS platforms have underscored the importance of multi-factor authentication (MFA) and identity monitoring to stop attackers.

Vulnerability exploits grab the headlines, but the most common attack methods are those that do not require advanced technical skills. These are usually targeted via social engineering, such as phishing, credential stuffing, or exploitation of hardware or software vulnerabilities that have been known for some time. For example, the breach of 23andMe exposed the personal information of 815 million Indian citizens in October, while attacks against the ICMR and Heathrow airport operations showed how easy it is to use stolen credentials to gain access to systems.